From 50aef091890514c5738156130ba23bdfb2592788 Mon Sep 17 00:00:00 2001 From: imp Date: Wed, 6 Sep 2006 19:46:02 +0000 Subject: MFp4: check the return value of malloc and report an error when invalid. --- sys/dev/iicbus/iic.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'sys/dev/iicbus/iic.c') diff --git a/sys/dev/iicbus/iic.c b/sys/dev/iicbus/iic.c index b50d2e0..038a8e8 100644 --- a/sys/dev/iicbus/iic.c +++ b/sys/dev/iicbus/iic.c @@ -282,6 +282,10 @@ iicioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags, struct thread *t break; } buf = malloc((unsigned long)s->count, M_TEMP, M_WAITOK); + if (buf == NULL) { + error = ENOMEM; + break; + } error = copyin(s->buf, buf, s->count); if (error) break; @@ -294,6 +298,10 @@ iicioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags, struct thread *t break; } buf = malloc((unsigned long)s->count, M_TEMP, M_WAITOK); + if (buf == NULL) { + error = ENOMEM; + break; + } error = iicbus_read(parent, buf, s->count, &count, s->last, 10); if (error) break; @@ -302,7 +310,15 @@ iicioctl(struct cdev *dev, u_long cmd, caddr_t data, int flags, struct thread *t case I2CRDWR: buf = malloc(sizeof(*d->msgs) * d->nmsgs, M_TEMP, M_WAITOK); + if (buf == NULL) { + error = ENOMEM; + break; + } usrbufs = malloc(sizeof(void *) * d->nmsgs, M_TEMP, M_ZERO | M_WAITOK); + if (usrbufs == NULL) { + error = ENOMEM; + break; + } error = copyin(d->msgs, buf, sizeof(*d->msgs) * d->nmsgs); if (error) break; -- cgit v1.1