kernel/net/wireless/wext-core.c
.. .. @@ -796,6 +796,12 @@ 796 796 } 797 797 } 798 798 799 + /* Sanity-check to ensure we never end up _allocating_ zero800 + * bytes of data for extra.801 + */802 + if (extra_size <= 0)803 + return -EFAULT;804 +799 805 /* kzalloc() ensures NULL-termination for essid_compat. */ 800 806 extra = kzalloc(extra_size, GFP_KERNEL); 801 807 if (!extra)