--- /usr/src/linux/mm/mmap.c.orig 2002-10-14 11:16:40.000000000 +0200 +++ /usr/src/linux/kernel/mm/mmap.c 2002-10-14 11:19:32.000000000 +0200 @@ -390,6 +390,12 @@ return 0; } + +/* + * NOTE: in this function we rely on TASK_SIZE being lower than + * SIZE_MAX-PAGE_SIZE at least. I'm pretty sure that it is. + */ + unsigned long do_mmap_pgoff(struct file * file, unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, unsigned long pgoff) { @@ -403,12 +409,14 @@ if (file && (!file->f_op || !file->f_op->mmap)) return -ENODEV; - if ((len = PAGE_ALIGN(len)) == 0) + if (!len) return addr; if (len > TASK_SIZE) return -EINVAL; + len = PAGE_ALIGN(len); /* This cannot be zero now */ + /* offset overflow? */ if ((pgoff + (len >> PAGE_SHIFT)) < pgoff) return -EINVAL;