Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck...

[linux-drm-fsl-dcu.git] / drivers / media / dvb-frontends / itd1000.c

diff --git a/drivers/media/dvb-frontends/itd1000.c b/drivers/media/dvb-frontends/itd1000.c
index c1c3400b2173508d3ce2ba77b236d16c2eec48c9..cadcae4cff89122dbf90cad2d02cfa9fa13854b4 100644 (file)
--- a/drivers/media/dvb-frontends/itd1000.c
+++ b/drivers/media/dvb-frontends/itd1000.c
@@ -31,6 +31,9 @@
 #include "itd1000.h"
 #include "itd1000_priv.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 static int debug;
 module_param(debug, int, 0644);
 MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
@@ -52,10 +55,18 @@ MODULE_PARM_DESC(debug, "Turn on/off debugging (default:off).");
 /* don't write more than one byte with flexcop behind */
 static int itd1000_write_regs(struct itd1000_state *state, u8 reg, u8 v[], u8 len)
 {
-       u8 buf[1+len];
+       u8 buf[MAX_XFER_SIZE];
        struct i2c_msg msg = {
                .addr = state->cfg->i2c_address, .flags = 0, .buf = buf, .len = len+1
        };
+
+       if (1 + len > sizeof(buf)) {
+               printk(KERN_WARNING
+                      "itd1000: i2c wr reg=%04x: len=%d is too big!\n",
+                      reg, len);
+               return -EINVAL;
+       }
+
        buf[0] = reg;
        memcpy(&buf[1], v, len);