import PULS_20180308

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / sound / core / info.c

diff --git a/sound/core/info.c b/sound/core/info.c
index e79baa11b60eb15526ba3679537720b2f29d0de6..f94708590e6170992988ea2adad4aaf80a81fa20 100644 (file)
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -253,6 +253,7 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer
        struct snd_info_buffer *buf;
        ssize_t size = 0;
        loff_t pos;
+       unsigned long realloc_size;
 
        data = file->private_data;
        if (snd_BUG_ON(!data))
@@ -261,7 +262,8 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer
        pos = *offset;
        if (pos < 0 || (long) pos != pos || (ssize_t) count < 0)
                return -EIO;
-       if ((unsigned long) pos + (unsigned long) count < (unsigned long) pos)
+       realloc_size = (unsigned long) pos + (unsigned long) count;
+       if (realloc_size < (unsigned long) pos || realloc_size > UINT_MAX)
                return -EIO;
        switch (entry->content) {
        case SNDRV_INFO_CONTENT_TEXT: