Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck...

[linux-drm-fsl-dcu.git] / drivers / media / dvb-frontends / nxt200x.c

diff --git a/drivers/media/dvb-frontends/nxt200x.c b/drivers/media/dvb-frontends/nxt200x.c
index 8e288940a61fcb0654034dde41457de506e25a8f..fbca9856313a8b8a0cfb9fe34705c1f350e31a3e 100644 (file)
--- a/drivers/media/dvb-frontends/nxt200x.c
+++ b/drivers/media/dvb-frontends/nxt200x.c
@@ -39,6 +39,9 @@
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 #define NXT2002_DEFAULT_FIRMWARE "dvb-fe-nxt2002.fw"
 #define NXT2004_DEFAULT_FIRMWARE "dvb-fe-nxt2004.fw"
 #define CRC_CCIT_MASK 0x1021
@@ -95,10 +98,16 @@ static int i2c_readbytes(struct nxt200x_state *state, u8 addr, u8 *buf, u8 len)
 static int nxt200x_writebytes (struct nxt200x_state* state, u8 reg,
                               const u8 *buf, u8 len)
 {
-       u8 buf2 [len+1];
+       u8 buf2[MAX_XFER_SIZE];
        int err;
        struct i2c_msg msg = { .addr = state->config->demod_address, .flags = 0, .buf = buf2, .len = len + 1 };
 
+       if (1 + len > sizeof(buf2)) {
+               pr_warn("%s: i2c wr reg=%04x: len=%d is too big!\n",
+                        __func__, reg, len);
+               return -EINVAL;
+       }
+
        buf2[0] = reg;
        memcpy(&buf2[1], buf, len);