Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: talitos - fix bug in sg_copy_end_to_buffer

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 637c105f53d262f904230c77b5bc5a5a5234fda7..bd78acf3c365aa1910a467f3fce882fa26c84841 100644 (file)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -1183,10 +1183,14 @@ static size_t sg_copy_end_to_buffer(struct scatterlist *sgl, unsigned int nents,
                                /* Copy part of this segment */
                                ignore = skip - offset;
                                len = miter.length - ignore;
+                               if (boffset + len > buflen)
+                                       len = buflen - boffset;
                                memcpy(buf + boffset, miter.addr + ignore, len);
                        } else {
-                               /* Copy all of this segment */
+                               /* Copy all of this segment (up to buflen) */
                                len = miter.length;
+                               if (boffset + len > buflen)
+                                       len = buflen - boffset;
                                memcpy(buf + boffset, miter.addr, len);
                        }
                        boffset += len;