diff options
Diffstat (limited to 'sys-kernel/gaming-sources/files/gaming-sources-2.4.20.I2C_Limits.patch')
| -rw-r--r-- | sys-kernel/gaming-sources/files/gaming-sources-2.4.20.I2C_Limits.patch | 44 |
1 files changed, 0 insertions, 44 deletions
diff --git a/sys-kernel/gaming-sources/files/gaming-sources-2.4.20.I2C_Limits.patch b/sys-kernel/gaming-sources/files/gaming-sources-2.4.20.I2C_Limits.patch deleted file mode 100644 index af20a6fc0c2c..000000000000 --- a/sys-kernel/gaming-sources/files/gaming-sources-2.4.20.I2C_Limits.patch +++ /dev/null @@ -1,44 +0,0 @@ ---- linux-2.4.20/drivers/i2c/i2c-dev.c 2004-06-19 03:27:30 -07:00 -+++ linux-2.4.21/drivers/i2c/i2c-dev.c 2004-06-19 03:27:30 -07:00 -@@ -254,6 +254,11 @@ - sizeof(rdwr_arg))) - return -EFAULT; - -+ /* Put an arbritrary limit on the number of messages that can -+ * be sent at once */ -+ if (rdwr_arg.nmsgs > 42) -+ return -EINVAL; -+ - rdwr_pa = (struct i2c_msg *) - kmalloc(rdwr_arg.nmsgs * sizeof(struct i2c_msg), - GFP_KERNEL); -@@ -270,6 +275,11 @@ - res = -EFAULT; - break; - } -+ /* Limit the size of the message to a sane amount */ -+ if (rdwr_pa[i].len > 8192) { -+ res = -EINVAL; -+ break; -+ } - rdwr_pa[i].buf = kmalloc(rdwr_pa[i].len, GFP_KERNEL); - if(rdwr_pa[i].buf == NULL) - { -@@ -280,10 +290,16 @@ - rdwr_arg.msgs[i].buf, - rdwr_pa[i].len)) - { -- kfree(rdwr_pa[i].buf); - res = -EFAULT; - break; - } -+ } -+ if (res < 0) { -+ int j; -+ for (j = 0; j < i; ++j) -+ kfree(rdwr_pa[j].buf); -+ kfree(rdwr_pa); -+ return res; - } - if (!res) - { |