diff -uNr linux-2.4.27-pa4-r2.orig/fs/binfmt_aout.c linux-2.4.27-pa4-r2/fs/binfmt_aout.c
--- linux-2.4.27-pa4-r2.orig/fs/binfmt_aout.c	2004-12-08 18:24:03.899156592 +0100
+++ linux-2.4.27-pa4-r2/fs/binfmt_aout.c	2004-12-08 18:24:25.898812136 +0100
@@ -39,13 +39,18 @@
 	NULL, THIS_MODULE, load_aout_binary, load_aout_library, aout_core_dump, PAGE_SIZE
 };
 
-static void set_brk(unsigned long start, unsigned long end)
+#define BAD_ADDR(x)	((unsigned long)(x) >= TASK_SIZE)
+
+static int set_brk(unsigned long start, unsigned long end)
 {
 	start = PAGE_ALIGN(start);
 	end = PAGE_ALIGN(end);
-	if (end <= start)
-		return;
-	do_brk(start, end - start);
+	if (end > start) {
+		unsigned long addr = do_brk(start, end - start);
+		if (BAD_ADDR(addr))
+			return addr;
+	}
+	return 0;
 }
 
 /*
@@ -405,7 +410,11 @@
 beyond_if:
 	set_binfmt(&aout_format);
 
-	set_brk(current->mm->start_brk, current->mm->brk);
+	retval = set_brk(current->mm->start_brk, current->mm->brk);
+	if (retval < 0) {
+		send_sig(SIGKILL, current, 0);
+		return retval;
+	}
 
 	retval = setup_arg_pages(bprm); 
 	if (retval < 0) { 
diff -uNr linux-2.4.27-pa4-r2.orig/fs/exec.c linux-2.4.27-pa4-r2/fs/exec.c
--- linux-2.4.27-pa4-r2.orig/fs/exec.c	2004-12-08 18:24:03.808170424 +0100
+++ linux-2.4.27-pa4-r2/fs/exec.c	2004-12-08 18:26:20.552382144 +0100
@@ -382,6 +382,7 @@
 	
 	down_write(&current->mm->mmap_sem);
 	{
+		struct vm_area_struct *vma;
 		mpnt->vm_mm = mm;
 #ifdef ARCH_STACK_GROWSUP
 		mpnt->vm_start = stack_base;
@@ -397,6 +398,12 @@
 		mpnt->vm_pgoff = 0;
 		mpnt->vm_file = NULL;
 		mpnt->vm_private_data = (void *) 0;
+		vma = find_vma(current->mm, mpnt->vm_start);
+		if (vma) {
+			up_write(&current->mm->mmap_sem);
+			kmem_cache_free(vm_area_cachep, mpnt);
+			return -ENOMEM;
+		}
 		insert_vm_struct(mm, mpnt);
 		mm->total_vm = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
 	}