diff options
| author | fire855 <thefire855@gmail.com> | 2017-01-05 23:52:53 +0100 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-04-16 15:03:42 +0200 |
| commit | f81ee65aedf25f7279cb1023081823e815a6e708 (patch) | |
| tree | db634b62ea1f0b442d4cac5e5b26c36b5c821347 /sound | |
| parent | c382e6cf7d25f7b216f670c739bd490d36f848f2 (diff) | |
Security patches
Signed-off-by: Mister Oyster <oysterized@gmail.com>
Diffstat (limited to 'sound')
| -rw-r--r-- | sound/core/info.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sound/core/info.c b/sound/core/info.c index 332c9a1ef..8d92d7ccc 100644 --- a/sound/core/info.c +++ b/sound/core/info.c @@ -206,6 +206,7 @@ static ssize_t snd_info_entry_read(struct file *file, char __user *buffer, struct snd_info_buffer *buf; size_t size = 0; loff_t pos; + unsigned long realloc_size; data = file->private_data; if (snd_BUG_ON(!data)) @@ -213,7 +214,8 @@ static ssize_t snd_info_entry_read(struct file *file, char __user *buffer, pos = *offset; if (pos < 0 || (long) pos != pos || (ssize_t) count < 0) return -EIO; - if ((unsigned long) pos + (unsigned long) count < (unsigned long) pos) + realloc_size = (unsigned long) pos + (unsigned long) count; + if (realloc_size < (unsigned long) pos || realloc_size > UINT_MAX) return -EIO; entry = data->entry; switch (entry->content) { |