From 52d802d65b56a399aa67a9d3f26f232116d3e256 Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Tue, 12 Jul 2016 11:10:41 -0300 Subject: [media] cec: add sanity check for msg->len Check (and warn) if the msg->len is too long or if it is 0. Should never happen, but just in case... Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/staging/media/cec/cec-adap.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers/staging') diff --git a/drivers/staging/media/cec/cec-adap.c b/drivers/staging/media/cec/cec-adap.c index f184bf6945cc..3925e0ae62a5 100644 --- a/drivers/staging/media/cec/cec-adap.c +++ b/drivers/staging/media/cec/cec-adap.c @@ -763,6 +763,9 @@ void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg) bool is_reply = false; bool valid_la = true; + if (WARN_ON(!msg->len || msg->len > CEC_MAX_MSG_SIZE)) + return; + mutex_lock(&adap->lock); msg->ts = ktime_get_ns(); msg->rx_status = CEC_RX_STATUS_OK; -- cgit v1.2.3