diff options
Diffstat (limited to 'drivers/media/dvb-frontends/stv0367.c')
| -rw-r--r-- | drivers/media/dvb-frontends/stv0367.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/drivers/media/dvb-frontends/stv0367.c b/drivers/media/dvb-frontends/stv0367.c index 0c8e45949b1..45877273942 100644 --- a/drivers/media/dvb-frontends/stv0367.c +++ b/drivers/media/dvb-frontends/stv0367.c @@ -33,6 +33,9 @@ #include "stv0367_regs.h" #include "stv0367_priv.h" +/* Max transfer size done by I2C transfer functions */ +#define MAX_XFER_SIZE 64 + static int stvdebug; module_param_named(debug, stvdebug, int, 0644); @@ -767,7 +770,7 @@ static struct st_register def0367cab[STV0367CAB_NBREGS] = { static int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len) { - u8 buf[len + 2]; + u8 buf[MAX_XFER_SIZE]; struct i2c_msg msg = { .addr = state->config->demod_address, .flags = 0, @@ -776,6 +779,14 @@ int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len) }; int ret; + if (2 + len > sizeof(buf)) { + printk(KERN_WARNING + "%s: i2c wr reg=%04x: len=%d is too big!\n", + KBUILD_MODNAME, reg, len); + return -EINVAL; + } + + buf[0] = MSB(reg); buf[1] = LSB(reg); memcpy(buf + 2, data, len); @@ -2919,7 +2930,7 @@ enum stv0367_cab_signal_type stv0367cab_algo(struct stv0367_state *state, if (tuner_lock == 0) return FE_367CAB_NOTUNER; #endif - /* Relase the TRL to start demodulator acquisition */ + /* Release the TRL to start demodulator acquisition */ /* Wait for QAM lock */ LockTime = 0; stv0367_writereg(state, R367CAB_CTRL_1, 0x00); |