From: Muli Ben-Yehuda <mulix@mulix.org>

This patch add proper bounds checking to the sb_mixer.c code, found by the
stanford checker[0].  It fixes bugzilla bugs 252[1], 253[2] and 254[3]. 
Patch is against 2.6.5-rc2.  It was tested by Rene Herman on SN AWE64 gold
and sound still works.  The issue was previously discussed on lkml[4], but
apparently no fix was applied.

The patch is a bit more intrusive than I would've liked, but I don't think
it can be helped without really intrusive changes.  sb_devc has a pointer
to an array (iomap) that is set at run time to point to arrays of variable
sizes.  The patch adds an 'iomap_sz' member to sb_devc that is set to the
length of the array, and does bounds checking in sb_common_mixer_set() and
smw_mixer_set() agains that.