Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media updates from Mauro Carvalho Chehab:
 "This series contains:
   - Exynos s5p-mfc driver got support for VP8 encoder
   - Some SoC drivers gained support for asynchronous registration
     (needed for DT)
   - The RC subsystem gained support for RC activity LED;
   - New drivers added: a video decoder(adv7842), a video encoder
     (adv7511), a new GSPCA driver (stk1135) and support for Renesas
     R-Car (vsp1)
   - the first SDR kernel driver: mirics msi3101.  Due to some troubles
     with the driver, and because the API is still under discussion, it
     will be merged at staging for 3.12.  Need to rework on it
   - usual new boards additions, fixes, cleanups and driver
     improvements"

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (242 commits)
  [media] cx88: Fix regression: CX88_AUDIO_WM8775 can't be 0
  [media] exynos4-is: Fix entity unregistration on error path
  [media] exynos-gsc: Register v4l2 device
  [media] exynos4-is: Fix fimc-lite bayer formats
  [media] em28xx: fix assignment of the eeprom data
  [media] hdpvr: fix iteration over uninitialized lists in hdpvr_probe()
  [media] usbtv: Throw corrupted frames away
  [media] usbtv: Fix deinterlacing
  [media] v4l2: added missing mutex.h include to v4l2-ctrls.h
  [media] DocBook: upgrade media_api DocBook version to 4.2
  [media] ml86v7667: fix compile warning: 'ret' set but not used
  [media] s5p-g2d: Fix registration failure
  [media] media: coda: Fix DT driver data pointer for i.MX27
  [media] s5p-mfc: Fix input/output format reporting
  [media] v4l: vsp1: Fix mutex double lock at streamon time
  [media] v4l: vsp1: Add support for RT clock
  [media] v4l: vsp1: Initialize media device bus_info field
  [media] davinci: vpif_capture: fix error return code in vpif_probe()
  [media] davinci: vpif_display: fix error return code in vpif_probe()
  [media] MAINTAINERS: add entries for adv7511 and adv7842
  ...

1 files changed, 11 insertions, 1 deletions

diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
index e4561264e124..ed2c8a1ed8ca 100644
--- a/drivers/media/rc/ir-lirc-codec.c
+++ b/drivers/media/rc/ir-lirc-codec.c
@@ -140,11 +140,20 @@ static ssize_t ir_lirc_transmit_ir(struct file *file, const char __user *buf,
 		goto out;
 	}
 
+	for (i = 0; i < count; i++) {
+		if (txbuf[i] > IR_MAX_DURATION / 1000 - duration || !txbuf[i]) {
+			ret = -EINVAL;
+			goto out;
+		}
+
+		duration += txbuf[i];
+	}
+
 	ret = dev->tx_ir(dev, txbuf, count);
 	if (ret < 0)
 		goto out;
 
-	for (i = 0; i < ret; i++)
+	for (duration = i = 0; i < ret; i++)
 		duration += txbuf[i];
 
 	ret *= sizeof(unsigned int);
@@ -375,6 +384,7 @@ static int ir_lirc_register(struct rc_dev *dev)
 	drv->code_length = sizeof(struct ir_raw_event) * 8;
 	drv->fops = &lirc_fops;
 	drv->dev = &dev->dev;
+	drv->rdev = dev;
 	drv->owner = THIS_MODULE;
 
 	drv->minor = lirc_register_driver(drv);