summaryrefslogtreecommitdiff
path: root/drivers/media
diff options
context:
space:
mode:
authorAntti Palosaari <crope@iki.fi>2011-05-24 06:04:08 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2011-06-01 08:34:45 -0300
commit21d2e938d34d201276de3470587a3aa2047c77a1 (patch)
tree39720f57893084f8accf03efbfa815c4b4203c45 /drivers/media
parentc8ef0a5b70a9821b3d75097aba672f531619231b (diff)
[media] anysee: return EOPNOTSUPP for unsupported I2C messages
Check I2C messages and return error properly. Signed-off-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media')
-rw-r--r--drivers/media/dvb/dvb-usb/anysee.c17
1 files changed, 11 insertions, 6 deletions
diff --git a/drivers/media/dvb/dvb-usb/anysee.c b/drivers/media/dvb/dvb-usb/anysee.c
index 4dc1ca333236..7c327b54308e 100644
--- a/drivers/media/dvb/dvb-usb/anysee.c
+++ b/drivers/media/dvb/dvb-usb/anysee.c
@@ -60,8 +60,6 @@ static int anysee_ctrl_msg(struct dvb_usb_device *d, u8 *sbuf, u8 slen,
int act_len, ret;
u8 buf[64];
- if (slen > sizeof(buf))
- slen = sizeof(buf);
memcpy(&buf[0], sbuf, slen);
buf[60] = state->seq++;
@@ -180,30 +178,37 @@ static int anysee_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msg,
{
struct dvb_usb_device *d = i2c_get_adapdata(adap);
int ret = 0, inc, i = 0;
+ u8 buf[52]; /* 4 + 48 (I2C WR USB command header + I2C WR max) */
if (mutex_lock_interruptible(&d->i2c_mutex) < 0)
return -EAGAIN;
while (i < num) {
if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
- u8 buf[6];
+ if (msg[i].len > 2 || msg[i+1].len > 60) {
+ ret = -EOPNOTSUPP;
+ break;
+ }
buf[0] = CMD_I2C_READ;
buf[1] = (msg[i].addr << 1) | 0x01;
buf[2] = msg[i].buf[0];
buf[3] = msg[i].buf[1];
buf[4] = msg[i].len-1;
buf[5] = msg[i+1].len;
- ret = anysee_ctrl_msg(d, buf, sizeof(buf), msg[i+1].buf,
+ ret = anysee_ctrl_msg(d, buf, 6, msg[i+1].buf,
msg[i+1].len);
inc = 2;
} else {
- u8 buf[4+msg[i].len];
+ if (msg[i].len > 48) {
+ ret = -EOPNOTSUPP;
+ break;
+ }
buf[0] = CMD_I2C_WRITE;
buf[1] = (msg[i].addr << 1);
buf[2] = msg[i].len;
buf[3] = 0x01;
memcpy(&buf[4], msg[i].buf, msg[i].len);
- ret = anysee_ctrl_msg(d, buf, sizeof(buf), NULL, 0);
+ ret = anysee_ctrl_msg(d, buf, 4 + msg[i].len, NULL, 0);
inc = 1;
}
if (ret)