From: Dan Carpenter Date: Wed, 26 Sep 2012 07:21:48 +0000 (+0300) Subject: brcmfmac: use kcalloc() to prevent integer overflow X-Git-Tag: android-x86-4.4-r1~2235^2~30^2~17 X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=58901d181f12807d6bfa7ef29547b560740dd305;p=android-x86%2Fkernel.git brcmfmac: use kcalloc() to prevent integer overflow The multiplication here looks like it could overflow. I've changed it to use kcalloc() to prevent that. Signed-off-by: Dan Carpenter Acked-by: Arend van Spriel Signed-off-by: John W. Linville --- diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c index e40cfe846a48..24e8f8d708ad 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c @@ -3297,8 +3297,8 @@ brcmf_notify_sched_scan_results(struct brcmf_cfg80211_priv *cfg_priv, int i; request = kzalloc(sizeof(*request), GFP_KERNEL); - ssid = kzalloc(sizeof(*ssid) * result_count, GFP_KERNEL); - channel = kzalloc(sizeof(*channel) * result_count, GFP_KERNEL); + ssid = kcalloc(result_count, sizeof(*ssid), GFP_KERNEL); + channel = kcalloc(result_count, sizeof(*channel), GFP_KERNEL); if (!request || !ssid || !channel) { err = -ENOMEM; goto out_err;