summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorHans Verkuil <hverkuil-cisco@xs4all.nl>2022-08-24 10:00:24 +0300
committerMauro Carvalho Chehab <mchehab@kernel.org>2022-08-30 08:37:24 +0300
commit3028fb90f5b972ef9b9e68e75a8372b8f9a8e312 (patch)
tree22725baf87ffa05b50930268c15b7f72e62a24cf /drivers
parent05c480f4d0ba438e6d37a1660d81cc7eb670e26b (diff)
downloadlinux-3028fb90f5b972ef9b9e68e75a8372b8f9a8e312.tar.xz
media: tc358743: limit msg.len to CEC_MAX_MSG_SIZE
I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case. Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/media/i2c/tc358743.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index e18b8947ad7e..804b8ee8e4ab 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -964,6 +964,8 @@ static void tc358743_cec_handler(struct v4l2_subdev *sd, u16 intstatus,
v = i2c_rd32(sd, CECRCTR);
msg.len = v & 0x1f;
+ if (msg.len > CEC_MAX_MSG_SIZE)
+ msg.len = CEC_MAX_MSG_SIZE;
for (i = 0; i < msg.len; i++) {
v = i2c_rd32(sd, CECRBUF1 + i * 4);
msg.msg[i] = v & 0xff;