--- sound/pci/mixart/mixart.c

+++ sound/pci/mixart/mixart.c

@@ -1161,13 +1161,15 @@ static long snd_mixart_BA0_read(struct s

unsigned long count, unsigned long pos)

{

struct mixart_mgr *mgr = entry->private_data;

+ unsigned long maxsize;

- count = count & ~3; /* make sure the read size is a multiple of 4 bytes */

- if(count <= 0)

+ if (pos >= MIXART_BA0_SIZE)

return 0;

- if(pos + count > MIXART_BA0_SIZE)

- count = (long)(MIXART_BA0_SIZE - pos);

- if(copy_to_user_fromio(buf, MIXART_MEM( mgr, pos ), count))

+ maxsize = MIXART_BA0_SIZE - pos;

+ if (count > maxsize)

+ count = maxsize;

+ count = count & ~3; /* make sure the read size is a multiple of 4 bytes */

+ if (copy_to_user_fromio(buf, MIXART_MEM(mgr, pos), count))

return -EFAULT;

return count;

}

@@ -1180,13 +1182,15 @@ static long snd_mixart_BA1_read(struct s

unsigned long count, unsigned long pos)

{

struct mixart_mgr *mgr = entry->private_data;

+ unsigned long maxsize;

- count = count & ~3; /* make sure the read size is a multiple of 4 bytes */

- if(count <= 0)

+ if (pos > MIXART_BA1_SIZE)

return 0;

- if(pos + count > MIXART_BA1_SIZE)

- count = (long)(MIXART_BA1_SIZE - pos);

- if(copy_to_user_fromio(buf, MIXART_REG( mgr, pos ), count))

+ maxsize = MIXART_BA1_SIZE - pos;

+ if (count > maxsize)

+ count = maxsize;

+ count = count & ~3; /* make sure the read size is a multiple of 4 bytes */

+ if (copy_to_user_fromio(buf, MIXART_REG(mgr, pos), count))

return -EFAULT;

return count;

}