diff options
| author | Hans Verkuil <hverkuil-cisco@xs4all.nl> | 2019-04-23 15:37:39 +0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab+samsung@kernel.org> | 2019-05-23 12:30:47 +0300 |
| commit | 63d171f85fb15247600bdd38b1dbf72bcba0dc8a (patch) | |
| tree | f40868c055d189a0d6a0992c1e99928b69d5da35 /drivers/media/cec/cec-adap.c | |
| parent | 00ccd263ee085c7428e2a1102c2f39e4a6927978 (diff) | |
| download | linux-63d171f85fb15247600bdd38b1dbf72bcba0dc8a.tar.xz | |
media: cec: cec_transmit_msg_fh: do sanity checks first
The code that fills in the CEC_MSG_CDC_MESSAGE physical address
is now done after the sanity checks. It also only does this if the
message length is >= 4 (i.e. there is room for the physical address).
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Diffstat (limited to 'drivers/media/cec/cec-adap.c')
| -rw-r--r-- | drivers/media/cec/cec-adap.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c index f1261cc2b6fa..b6102510e203 100644 --- a/drivers/media/cec/cec-adap.c +++ b/drivers/media/cec/cec-adap.c @@ -740,11 +740,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, else msg->flags = 0; - if (msg->len > 1 && msg->msg[1] == CEC_MSG_CDC_MESSAGE) { - msg->msg[2] = adap->phys_addr >> 8; - msg->msg[3] = adap->phys_addr & 0xff; - } - /* Sanity checks */ if (msg->len == 0 || msg->len > CEC_MAX_MSG_SIZE) { dprintk(1, "%s: invalid length %d\n", __func__, msg->len); @@ -765,6 +760,12 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, dprintk(1, "%s: can't reply to poll msg\n", __func__); return -EINVAL; } + + if (msg->len >= 4 && msg->msg[1] == CEC_MSG_CDC_MESSAGE) { + msg->msg[2] = adap->phys_addr >> 8; + msg->msg[3] = adap->phys_addr & 0xff; + } + if (msg->len == 1) { if (cec_msg_destination(msg) == 0xf) { dprintk(1, "%s: invalid poll message\n", __func__); |