From: Chuck Ebbert <76306.1226@compuserve.com> Fix check for bad address; use macro instead of open-coding two checks. Taken from RHEL4 kernel update. Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com> Cc: Ernie Petrides Signed-off-by: Andrew Morton --- fs/binfmt_elf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff -puN fs/binfmt_elf.c~binfmt_elf-fix-checks-for-bad-address fs/binfmt_elf.c --- a/fs/binfmt_elf.c~binfmt_elf-fix-checks-for-bad-address +++ a/fs/binfmt_elf.c @@ -84,7 +84,7 @@ static struct linux_binfmt elf_format = .min_coredump = ELF_EXEC_PAGESIZE }; -#define BAD_ADDR(x) ((unsigned long)(x) > TASK_SIZE) +#define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE) static int set_brk(unsigned long start, unsigned long end) { @@ -394,7 +394,7 @@ static unsigned long load_elf_interp(str * <= p_memsize so it's only necessary to check p_memsz. */ k = load_addr + eppnt->p_vaddr; - if (k > TASK_SIZE || + if (BAD_ADDR(k) || eppnt->p_filesz > eppnt->p_memsz || eppnt->p_memsz > TASK_SIZE || TASK_SIZE - eppnt->p_memsz < k) { @@ -887,7 +887,7 @@ static int load_elf_binary(struct linux_ * allowed task size. Note that p_filesz must always be * <= p_memsz so it is only necessary to check p_memsz. */ - if (k > TASK_SIZE || elf_ppnt->p_filesz > elf_ppnt->p_memsz || + if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz || elf_ppnt->p_memsz > TASK_SIZE || TASK_SIZE - elf_ppnt->p_memsz < k) { /* set_brk can never work. Avoid overflows. */ _