From: Hollis Blanchard <hollis@austin.ibm.com>

Fix a user pointer deref, found by the Stanford checker.


 25-akpm/drivers/media/video/zoran_procfs.c |    5 ++++-
 1 files changed, 4 insertions(+), 1 deletion(-)

diff -puN drivers/media/video/zoran_procfs.c~zoran_procfs-copy-user-fix drivers/media/video/zoran_procfs.c
--- 25/drivers/media/video/zoran_procfs.c~zoran_procfs-copy-user-fix	Tue May 27 15:50:07 2003
+++ 25-akpm/drivers/media/video/zoran_procfs.c	Tue May 27 15:50:07 2003
@@ -119,7 +119,10 @@ static int zoran_write_proc(struct file 
 		printk(KERN_ERR "%s: write_proc: can not allocate memory\n", zr->name);
 		return -ENOMEM;
 	}
-	memcpy(string, buffer, count);
+	if (copy_from_user(string, buffer, count)) {
+		vfree(string);
+		return -EFAULT;
+	}
 	string[count] = 0;
 	DEBUG2(printk(KERN_INFO "%s: write_proc: name=%s count=%lu data=%x\n", zr->name, file->f_dentry->d_name.name, count, (int) data));
 	ldelim = " \t\n";

_