[ALSA] emu10k1 - Fix over-sized kmalloc for TLV

Reported by Al Viro: In copy_tlv(), the size of kmalloc is wrongly calculated. Signed-off-by: Takashi Iwai <[email protected]> Signed-off-by: Jaroslav Kysela <[email protected]>
chewitt · Jan 31, 2008 · 6735e57 · 6735e57
1 parent 28a0d9d
commit 6735e57
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
@@ -665,7 +665,7 @@ static unsigned int *copy_tlv(const unsigned int __user *_tlv)
 		return NULL;
 	if (data[1] >= MAX_TLV_SIZE)
 		return NULL;
-	tlv = kmalloc(data[1] * 4 + sizeof(data), GFP_KERNEL);
+	tlv = kmalloc(data[1] + sizeof(data), GFP_KERNEL);
 	if (!tlv)
 		return NULL;
 	memcpy(tlv, data, sizeof(data));