diff options
Diffstat (limited to 'drivers/staging/tidspbridge/pmgr/dspapi.c')
| -rw-r--r-- | drivers/staging/tidspbridge/pmgr/dspapi.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/drivers/staging/tidspbridge/pmgr/dspapi.c b/drivers/staging/tidspbridge/pmgr/dspapi.c index 9ef1ad9527af..70db4ff99ec6 100644 --- a/drivers/staging/tidspbridge/pmgr/dspapi.c +++ b/drivers/staging/tidspbridge/pmgr/dspapi.c @@ -414,10 +414,13 @@ u32 mgrwrap_register_object(union trapped_args *args, void *pr_ctxt) CP_FM_USR(&uuid_obj, args->args_mgr_registerobject.uuid_obj, status, 1); if (status) goto func_end; - /* path_size is increased by 1 to accommodate NULL */ path_size = strlen_user((char *) - args->args_mgr_registerobject.sz_path_name) + - 1; + args->args_mgr_registerobject.sz_path_name); + if (!path_size) { + status = -EINVAL; + goto func_end; + } + psz_path_name = kmalloc(path_size, GFP_KERNEL); if (!psz_path_name) { status = -ENOMEM; @@ -1540,7 +1543,7 @@ u32 strmwrap_free_buffer(union trapped_args *args, void *pr_ctxt) if (num_bufs > MAX_BUFS) return -EINVAL; - ap_buffer = kmalloc((num_bufs * sizeof(u8 *)), GFP_KERNEL); + ap_buffer = kmalloc_array(num_bufs, sizeof(u8 *), GFP_KERNEL); if (ap_buffer == NULL) return -ENOMEM; |