[media] hd29l2: fix sparse error and warnings

drivers/media/dvb-frontends/hd29l2.c:29:18: warning: Variable length array is used.
drivers/media/dvb-frontends/hd29l2.c:34:32: error: cannot size expression
drivers/media/dvb-frontends/hd29l2.c:125:5: warning: symbol 'hd29l2_rd_reg_mask' was not declared. Should it be static?

Variable length arrays are frowned upon, so replace with a fixed length and check
that there won't be a buffer overrun.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Reviewed-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/dvb-frontends/hd29l2.c b/drivers/media/dvb-frontends/hd29l2.c
index d7b9d549156d4d923e6ea9c7a988c0849725dd0c..67c8e6df42e85491244a614ee56a70b43da3ce8c 100644 (file)
--- a/drivers/media/dvb-frontends/hd29l2.c
+++ b/drivers/media/dvb-frontends/hd29l2.c
@@ -22,20 +22,24 @@
 
 #include "hd29l2_priv.h"
 
+#define HD29L2_MAX_LEN (3)
+
 /* write multiple registers */
 static int hd29l2_wr_regs(struct hd29l2_priv *priv, u8 reg, u8 *val, int len)
 {
        int ret;
-       u8 buf[2 + len];
+       u8 buf[2 + HD29L2_MAX_LEN];
        struct i2c_msg msg[1] = {
                {
                        .addr = priv->cfg.i2c_addr,
                        .flags = 0,
-                       .len = sizeof(buf),
+                       .len = 2 + len,
                        .buf = buf,
                }
        };
 
+       if (len > HD29L2_MAX_LEN)
+               return -EINVAL;
        buf[0] = 0x00;
        buf[1] = reg;
        memcpy(&buf[2], val, len);
@@ -118,7 +122,7 @@ static int hd29l2_wr_reg_mask(struct hd29l2_priv *priv, u8 reg, u8 val, u8 mask)
 }
 
 /* read single register with mask */
-int hd29l2_rd_reg_mask(struct hd29l2_priv *priv, u8 reg, u8 *val, u8 mask)
+static int hd29l2_rd_reg_mask(struct hd29l2_priv *priv, u8 reg, u8 *val, u8 mask)
 {
        int ret, i;
        u8 tmp;