Merge tag 'v3.10.56' into update

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / sound / core / info.c

diff --git a/sound/core/info.c b/sound/core/info.c
index e79baa11b60eb15526ba3679537720b2f29d0de6..332c9a1ef173c9377d2abef4f2cb861fcfb9f166 100644 (file)
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -253,6 +253,7 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer
        struct snd_info_buffer *buf;
        ssize_t size = 0;
        loff_t pos;
+       unsigned long realloc_size;
 
        data = file->private_data;
        if (snd_BUG_ON(!data))
@@ -261,7 +262,8 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer
        pos = *offset;
        if (pos < 0 || (long) pos != pos || (ssize_t) count < 0)
                return -EIO;
-       if ((unsigned long) pos + (unsigned long) count < (unsigned long) pos)
+       realloc_size = (unsigned long) pos + (unsigned long) count;
+       if (realloc_size < (unsigned long) pos || realloc_size > UINT_MAX)
                return -EIO;
        switch (entry->content) {
        case SNDRV_INFO_CONTENT_TEXT:
@@ -679,7 +681,7 @@ int snd_info_card_free(struct snd_card *card)
  * snd_info_get_line - read one line from the procfs buffer
  * @buffer: the procfs buffer
  * @line: the buffer to store
- * @len: the max. buffer size - 1
+ * @len: the max. buffer size
  *
  * Reads one line from the buffer and stores the string.
  *
@@ -699,7 +701,7 @@ int snd_info_get_line(struct snd_info_buffer *buffer, char *line, int len)
                        buffer->stop = 1;
                if (c == '\n')
                        break;
-               if (len) {
+               if (len > 1) {
                        len--;
                        *line++ = c;
                }