Hi Andrew,

Attached patch fixes a potential integer overflow in zoran_procs.c (part
of the zr36067 driver). Bug was detected by Ken Ashcraft (see below),
you've probably received more of those.

Thanks to Ken for detecting.

Ronald

On Tue, 2004-04-06 at 02:45, Ken Ashcraft wrote:
> ---------------------------------------------------------
> [BUG]  vmalloc(count + 1) can overflow
> /home/kash/interface/linux-2.6.3/drivers/acpi/battery.c:591:acpi_battery_write_alarm: 
> NOTE:BOUND: Checking arg count [EXAMPLE=proc_dir_entry.write_proc-2]
> /home/kash/interface/linux-2.6.3/drivers/media/video/zoran_procfs.c:217:zoran_write_proc: 
> ERROR:BOUND: Not checking arg count [COUNTER=proc_dir_entry.write_proc-2] 
> [fit=2] [fit_fn=1] [fn_ex=0] [fn_counter=1] [ex=13] [counter=1] [z = 
> -0.367883603690978] [fn-z = -4.35889894354067]
>                          KERN_ERR
>                          "%s: write_proc: can not allocate memory\n",
>                          ZR_DEVNAME(zr));
>                  return -ENOMEM;
>          }
> 
> Error --->
>          if (copy_from_user(string, buffer, count)) {
>                  vfree (string);
>                  return -EFAULT;
>          }
> ---------------------------------------------------------