From 709d92083af0b0529f6e1d11d17718c9a1da8f01 Mon Sep 17 00:00:00 2001 From: Antti Palosaari Date: Fri, 17 Jun 2011 21:16:38 -0300 Subject: [PATCH] [media] af9015: add more I2C msg checks Return EOPNOTSUPP for too long messages. Signed-off-by: Antti Palosaari Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb/dvb-usb/af9015.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/media/dvb/dvb-usb/af9015.c b/drivers/media/dvb/dvb-usb/af9015.c index 0bfe83b63e01..41a7c430f9c1 100644 --- a/drivers/media/dvb/dvb-usb/af9015.c +++ b/drivers/media/dvb/dvb-usb/af9015.c @@ -292,6 +292,10 @@ Due to that the only way to select correct tuner is use demodulator I2C-gate. } if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) { + if (msg[i].len > 3 || msg[i+1].len > 61) { + ret = -EOPNOTSUPP; + goto error; + } if (msg[i].addr == af9015_af9013_config[0].demod_address) req.cmd = READ_MEMORY; @@ -306,6 +310,10 @@ Due to that the only way to select correct tuner is use demodulator I2C-gate. ret = af9015_ctrl_msg(d, &req); i += 2; } else if (msg[i].flags & I2C_M_RD) { + if (msg[i].len > 61) { + ret = -EOPNOTSUPP; + goto error; + } if (msg[i].addr == af9015_af9013_config[0].demod_address) { ret = -EINVAL; @@ -321,6 +329,10 @@ Due to that the only way to select correct tuner is use demodulator I2C-gate. ret = af9015_ctrl_msg(d, &req); i += 1; } else { + if (msg[i].len > 21) { + ret = -EOPNOTSUPP; + goto error; + } if (msg[i].addr == af9015_af9013_config[0].demod_address) req.cmd = WRITE_MEMORY; -- 2.39.5