diff options
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/staging/media/rtl2832u_sdr/rtl2832_sdr.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/staging/media/rtl2832u_sdr/rtl2832_sdr.c b/drivers/staging/media/rtl2832u_sdr/rtl2832_sdr.c index b09f7d8c12cf..104ee8af79af 100644 --- a/drivers/staging/media/rtl2832u_sdr/rtl2832_sdr.c +++ b/drivers/staging/media/rtl2832u_sdr/rtl2832_sdr.c @@ -156,7 +156,9 @@ static int rtl2832_sdr_wr(struct rtl2832_sdr_state *s, u8 reg, const u8 *val, int len) { int ret; - u8 buf[1 + len]; +#define MAX_WR_LEN 24 +#define MAX_WR_XFER_LEN (MAX_WR_LEN + 1) + u8 buf[MAX_WR_XFER_LEN]; struct i2c_msg msg[1] = { { .addr = s->cfg->i2c_addr, @@ -166,6 +168,9 @@ static int rtl2832_sdr_wr(struct rtl2832_sdr_state *s, u8 reg, const u8 *val, } }; + if (WARN_ON(len > MAX_WR_LEN)) + return -EINVAL; + buf[0] = reg; memcpy(&buf[1], val, len); |