diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-09-26 10:21:48 +0300 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2012-09-28 13:54:06 -0400 |
| commit | 58901d181f12807d6bfa7ef29547b560740dd305 (patch) | |
| tree | 76fa8a59d70d31f5827c95db25514e3e81b037dc | |
| parent | 365d2ebcaba5f08590b8a988d137f7139a8163a5 (diff) | |
| download | op-kernel-dev-58901d181f12807d6bfa7ef29547b560740dd305.zip op-kernel-dev-58901d181f12807d6bfa7ef29547b560740dd305.tar.gz | |
brcmfmac: use kcalloc() to prevent integer overflow
The multiplication here looks like it could overflow. I've changed it
to use kcalloc() to prevent that.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c index e40cfe8..24e8f8d 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c @@ -3297,8 +3297,8 @@ brcmf_notify_sched_scan_results(struct brcmf_cfg80211_priv *cfg_priv, int i; request = kzalloc(sizeof(*request), GFP_KERNEL); - ssid = kzalloc(sizeof(*ssid) * result_count, GFP_KERNEL); - channel = kzalloc(sizeof(*channel) * result_count, GFP_KERNEL); + ssid = kcalloc(result_count, sizeof(*ssid), GFP_KERNEL); + channel = kcalloc(result_count, sizeof(*channel), GFP_KERNEL); if (!request || !ssid || !channel) { err = -ENOMEM; goto out_err; |
