summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorHans Verkuil <hans.verkuil@cisco.com>2016-07-12 17:10:41 +0300
committerMauro Carvalho Chehab <mchehab@s-opensource.com>2016-07-13 13:58:12 +0300
commit52d802d65b56a399aa67a9d3f26f232116d3e256 (patch)
treed09f3a743b5ea319a5bda38bc849c04d26ef05bc /drivers
parent0385443fec6b56b4b22f1940ab8607a074a5c17a (diff)
downloadlinux-52d802d65b56a399aa67a9d3f26f232116d3e256.tar.xz
[media] cec: add sanity check for msg->len
Check (and warn) if the msg->len is too long or if it is 0. Should never happen, but just in case... Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/staging/media/cec/cec-adap.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/staging/media/cec/cec-adap.c b/drivers/staging/media/cec/cec-adap.c
index f184bf6945cc..3925e0ae62a5 100644
--- a/drivers/staging/media/cec/cec-adap.c
+++ b/drivers/staging/media/cec/cec-adap.c
@@ -763,6 +763,9 @@ void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg)
bool is_reply = false;
bool valid_la = true;
+ if (WARN_ON(!msg->len || msg->len > CEC_MAX_MSG_SIZE))
+ return;
+
mutex_lock(&adap->lock);
msg->ts = ktime_get_ns();
msg->rx_status = CEC_RX_STATUS_OK;