1 files changed, 2 insertions, 0 deletions
diff --git a/zaptel.c b/zaptel.c
index 4fc7da6..b5589d1 100755
--- a/zaptel.c
+++ b/zaptel.c
@@ -3049,6 +3049,8 @@ static int zt_chanandpseudo_ioctl(struct inode *inode, struct file *file, unsign
 			return -EINVAL;
 		if (bi.bufsize < 16)
 			return -EINVAL;
+		if (bi.bufsize * bi.numbufs > ZT_MAX_BUF_SPACE)
+			return -EINVAL;
 		chan->rxbufpolicy = bi.rxbufpolicy & 0x1;
 		chan->txbufpolicy = bi.txbufpolicy & 0x1;
 		if ((rv = zt_reallocbufs(chan,  bi.bufsize, bi.numbufs)))