From: Ian Abbott <abbotti@mev.co.uk>
Date: Wed, 23 Nov 2011 15:16:53 +0000 (+0000)
Subject: Check integer overflow in do_insnlist_ioctl().
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=8aa891b4d7327af2997c7eb038b85bd1513d9405;p=comedi.git

Check integer overflow in do_insnlist_ioctl().

Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
---

diff --git a/comedi/comedi_fops.c b/comedi/comedi_fops.c
index 4d3a5dd1..ed26d001 100644
--- a/comedi/comedi_fops.c
+++ b/comedi/comedi_fops.c
@@ -701,7 +701,9 @@ static int do_insnlist_ioctl(comedi_device * dev, void *arg, void *file)
 		goto error;
 	}
 
-	insns = kmalloc(sizeof(comedi_insn) * insnlist.n_insns, GFP_KERNEL);
+	if (insnlist.n_insns <= ULONG_MAX / sizeof(comedi_insn))
+		insns = kmalloc(sizeof(comedi_insn) * insnlist.n_insns,
+				GFP_KERNEL);
 	if (!insns) {
 		DPRINTK("kmalloc failed\n");
 		ret = -ENOMEM;