diff options
Diffstat (limited to 'drivers/media/usb/dvb-usb/ttusb2.c')
-rw-r--r-- | drivers/media/usb/dvb-usb/ttusb2.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/drivers/media/usb/dvb-usb/ttusb2.c b/drivers/media/usb/dvb-usb/ttusb2.c index f10717311e05..dd93c2c8fea9 100644 --- a/drivers/media/usb/dvb-usb/ttusb2.c +++ b/drivers/media/usb/dvb-usb/ttusb2.c | |||
@@ -78,6 +78,9 @@ static int ttusb2_msg(struct dvb_usb_device *d, u8 cmd, | |||
78 | u8 *s, *r = NULL; | 78 | u8 *s, *r = NULL; |
79 | int ret = 0; | 79 | int ret = 0; |
80 | 80 | ||
81 | if (4 + rlen > 64) | ||
82 | return -EIO; | ||
83 | |||
81 | s = kzalloc(wlen+4, GFP_KERNEL); | 84 | s = kzalloc(wlen+4, GFP_KERNEL); |
82 | if (!s) | 85 | if (!s) |
83 | return -ENOMEM; | 86 | return -ENOMEM; |
@@ -381,6 +384,22 @@ static int ttusb2_i2c_xfer(struct i2c_adapter *adap,struct i2c_msg msg[],int num | |||
381 | write_read = i+1 < num && (msg[i+1].flags & I2C_M_RD); | 384 | write_read = i+1 < num && (msg[i+1].flags & I2C_M_RD); |
382 | read = msg[i].flags & I2C_M_RD; | 385 | read = msg[i].flags & I2C_M_RD; |
383 | 386 | ||
387 | if (3 + msg[i].len > sizeof(obuf)) { | ||
388 | err("i2c wr len=%d too high", msg[i].len); | ||
389 | break; | ||
390 | } | ||
391 | if (write_read) { | ||
392 | if (3 + msg[i+1].len > sizeof(ibuf)) { | ||
393 | err("i2c rd len=%d too high", msg[i+1].len); | ||
394 | break; | ||
395 | } | ||
396 | } else if (read) { | ||
397 | if (3 + msg[i].len > sizeof(ibuf)) { | ||
398 | err("i2c rd len=%d too high", msg[i].len); | ||
399 | break; | ||
400 | } | ||
401 | } | ||
402 | |||
384 | obuf[0] = (msg[i].addr << 1) | (write_read | read); | 403 | obuf[0] = (msg[i].addr << 1) | (write_read | read); |
385 | if (read) | 404 | if (read) |
386 | obuf[1] = 0; | 405 | obuf[1] = 0; |