diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index 61f549b61abe05b84a643b2081439ed9a15644d6..8c1ebe42ad8dd4d1e6df1c5f70b404437286cb60 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -1880,6 +1880,10 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int ioctl_num, sizeof(p.init))); if (err) goto bail; + VERIFY(err, p.init.init.filelen >= 0 && + p.init.init.memlen >= 0); + if (err) + goto bail; VERIFY(err, 0 == fastrpc_init_process(fl, &p.init)); if (err) goto bail;