drivers/sbus/char/openprom.c: Verify user len in copyin_string.

9ba73e24 · David S. Miller · 5d15a9af · 9ba73e24
Commit 9ba73e24 authored Jul 22, 2002 by David S. Miller
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 0 deletions

drivers/sbus/char/openprom.c drivers/sbus/char/openprom.c +3 -0

No files found.
--- a/drivers/sbus/char/openprom.c
+++ b/drivers/sbus/char/openprom.c
@@ -334,6 +334,9 @@ static int copyin_string(char *user, size_t len, char **ptr)
 {
 	char *tmp;

+	if (len < 0 || len + 1 < 0)
+		return -EINVAL;
+
 	tmp = kmalloc(len + 1, GFP_KERNEL);
 	if (!tmp)
 		return -ENOMEM;