Merge tag 's390-6.6-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

[tomoyo/tomoyo-test1.git] / tools / iio / iio_generic_buffer.c

diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
index f8deae4..44bbf80 100644 (file)
--- a/tools/iio/iio_generic_buffer.c
+++ b/tools/iio/iio_generic_buffer.c
@@ -51,9 +51,9 @@ enum autochan {
  * Has the side effect of filling the channels[i].location values used
  * in processing the buffer output.
  **/
-static int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
+static unsigned int size_from_channelarray(struct iio_channel_info *channels, int num_channels)
 {
-       int bytes = 0;
+       unsigned int bytes = 0;
        int i = 0;
 
        while (i < num_channels) {
@@ -348,7 +348,7 @@ int main(int argc, char **argv)
        ssize_t read_size;
        int dev_num = -1, trig_num = -1;
        char *buffer_access = NULL;
-       int scan_size;
+       unsigned int scan_size;
        int noevents = 0;
        int notrigger = 0;
        char *dummy;
@@ -674,7 +674,16 @@ int main(int argc, char **argv)
        }
 
        scan_size = size_from_channelarray(channels, num_channels);
-       data = malloc(scan_size * buf_len);
+
+       size_t total_buf_len = scan_size * buf_len;
+
+       if (scan_size > 0 && total_buf_len / scan_size != buf_len) {
+               ret = -EFAULT;
+               perror("Integer overflow happened when calculate scan_size * buf_len");
+               goto error;
+       }
+
+       data = malloc(total_buf_len);
        if (!data) {
                ret = -ENOMEM;
                goto error;