--- drivers/scsi/gdth.c

+++ drivers/scsi/gdth.c

@@ -4174,6 +4174,14 @@ static int ioc_general(void __user *arg,

ha = gdth_find_ha(gen.ionode);

if (!ha)

return -EFAULT;

+

+ if (gen.data_len > INT_MAX)

+ return -EINVAL;

+ if (gen.sense_len > INT_MAX)

+ return -EINVAL;

+ if (gen.data_len + gen.sense_len > INT_MAX)

+ return -EINVAL;

+

if (gen.data_len + gen.sense_len != 0) {

if (!(buf = gdth_ioctl_alloc(ha, gen.data_len + gen.sense_len,

FALSE, &paddr)))