Check if amt is negative. If it is negative the call to memcpy() 
will fail. In that case return FALSE.

* device/kmsg.c (kmsg_read_done): Check if amt is negative.

---
 device/kmsg.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/device/kmsg.c b/device/kmsg.c
index f6a21da..25fa91a 100644
--- a/device/kmsg.c
+++ b/device/kmsg.c
@@ -169,7 +169,8 @@ kmsg_read_done (io_req_t ior)
   if (len < 0)
     len += KMSGBUFSIZE;
 
-  amt = ior->io_count;
+  if ((amt = ior->io_count) < 0)
+    return FALSE;
   if (amt > len)
     amt = len;
   
-- 
1.8.1.4


Reply via email to