patch-2.4.21 linux-2.4.21/drivers/net/wan/cosa.c

• Lines: 29
• Date: 2003-06-13 07:51:35.000000000 -0700
• Orig file: linux-2.4.20/drivers/net/wan/cosa.c
• Orig date: 2002-11-28 15:53:14.000000000 -0800

diff -urN linux-2.4.20/drivers/net/wan/cosa.c linux-2.4.21/drivers/net/wan/cosa.c
@@ -1030,7 +1030,8 @@
 		return -EPERM;
 	}
 
-	if (get_user(addr, &(d->addr)) ||
+	if (verify_area(VERIFY_READ, d, sizeof(*d)) ||
+	    __get_user(addr, &(d->addr)) ||
 	    __get_user(len, &(d->len)) ||
 	    __get_user(code, &(d->code)))
 		return -EFAULT;
@@ -1071,7 +1072,8 @@
 		return -EPERM;
 	}
 
-	if (get_user(addr, &(d->addr)) ||
+	if (verify_area(VERIFY_READ, d, sizeof(*d)) ||
+	    __get_user(addr, &(d->addr)) ||
 	    __get_user(len, &(d->len)) ||
 	    __get_user(code, &(d->code)))
 		return -EFAULT;
@@ -1079,7 +1081,7 @@
 	/* If something fails, force the user to reset the card */
 	cosa->firmware_status &= ~COSA_FW_RESET;
 
-	if ((i=readmem(cosa, d->code, len, addr)) < 0) {
+	if ((i=readmem(cosa, code, len, addr)) < 0) {
 		printk(KERN_NOTICE "cosa%d: reading memory failed: %d\n",
 			cosa->num, i);
 		return -EIO;