summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlyssa Milburn <amilburn@zall.org>2017-04-01 14:33:42 -0300
committerMauro Carvalho Chehab <mchehab@s-opensource.com>2017-04-18 12:52:41 -0300
commit821117dc21083a99dd99174c10848d70ff43de29 (patch)
treeba526813d5b48ecffbdf56281096c127f093c333
parente8357cdec3d1b6b42566ce3bc960e5e10c2b3787 (diff)
[media] digitv: limit messages to buffer size
Return an error rather than memcpy()ing beyond the end of the buffer. Internal callers use appropriate sizes, but digitv_i2c_xfer may not. Signed-off-by: Alyssa Milburn <amilburn@zall.org> Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
-rw-r--r--drivers/media/usb/dvb-usb/digitv.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb/digitv.c
index 4284f6984dc1..475a3c0cdee7 100644
--- a/drivers/media/usb/dvb-usb/digitv.c
+++ b/drivers/media/usb/dvb-usb/digitv.c
@@ -33,6 +33,9 @@ static int digitv_ctrl_msg(struct dvb_usb_device *d,
wo = (rbuf == NULL || rlen == 0); /* write-only */
+ if (wlen > 4 || rlen > 4)
+ return -EIO;
+
memset(st->sndbuf, 0, 7);
memset(st->rcvbuf, 0, 7);