diff options
| author | Dmitry Torokhov <dtor@insightbb.com> | 2006-11-04 22:42:39 -0500 |
|---|---|---|
| committer | Dmitry Torokhov <dtor@insightbb.com> | 2006-11-04 22:42:39 -0500 |
| commit | 752c58a471c108d64da1676b2925dfbd83eb177e (patch) | |
| tree | fbffa0d7c54cd812950dffc16d642c9d449f4faf /drivers/ide/ide-taskfile.c | |
| parent | e52b29c2a637f6854d71a45646d7283d984a6dad (diff) | |
| parent | 10b1fbdb0a0ca91847a534ad26d0bc250c25b74f (diff) | |
Merge rsync://rsync.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6
Diffstat (limited to 'drivers/ide/ide-taskfile.c')
| -rw-r--r-- | drivers/ide/ide-taskfile.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c index 1d0470c1f957..30175c7688e8 100644 --- a/drivers/ide/ide-taskfile.c +++ b/drivers/ide/ide-taskfile.c @@ -524,8 +524,8 @@ int ide_taskfile_ioctl (ide_drive_t *drive, unsigned int cmd, unsigned long arg) task_ioreg_t *hobsptr = args.hobRegister; int err = 0; int tasksize = sizeof(struct ide_task_request_s); - int taskin = 0; - int taskout = 0; + unsigned int taskin = 0; + unsigned int taskout = 0; u8 io_32bit = drive->io_32bit; char __user *buf = (char __user *)arg; @@ -538,8 +538,13 @@ int ide_taskfile_ioctl (ide_drive_t *drive, unsigned int cmd, unsigned long arg) return -EFAULT; } - taskout = (int) req_task->out_size; - taskin = (int) req_task->in_size; + taskout = req_task->out_size; + taskin = req_task->in_size; + + if (taskin > 65536 || taskout > 65536) { + err = -EINVAL; + goto abort; + } if (taskout) { int outtotal = tasksize; |