Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck...

[linux-drm-fsl-dcu.git] / drivers / media / pci / cx23885 / cimax2.c

diff --git a/drivers/media/pci/cx23885/cimax2.c b/drivers/media/pci/cx23885/cimax2.c
index 7344849183a77bc51e3a072dc31875dcba8fee90..16fa7ea4d4aa7d472ff9f59f6b0131ead21c2902 100644 (file)
--- a/drivers/media/pci/cx23885/cimax2.c
+++ b/drivers/media/pci/cx23885/cimax2.c
@@ -26,6 +26,10 @@
 #include "cx23885.h"
 #include "cimax2.h"
 #include "dvb_ca_en50221.h"
+
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 /**** Bit definitions for MC417_RWD and MC417_OEN registers  ***
   bits 31-16
 +-----------+
@@ -125,7 +129,7 @@ static int netup_write_i2c(struct i2c_adapter *i2c_adap, u8 addr, u8 reg,
                                                u8 *buf, int len)
 {
        int ret;
-       u8 buffer[len + 1];
+       u8 buffer[MAX_XFER_SIZE];
 
        struct i2c_msg msg = {
                .addr   = addr,
@@ -134,6 +138,13 @@ static int netup_write_i2c(struct i2c_adapter *i2c_adap, u8 addr, u8 reg,
                .len    = len + 1
        };
 
+       if (1 + len > sizeof(buffer)) {
+               printk(KERN_WARNING
+                      "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                      KBUILD_MODNAME, reg, len);
+               return -EINVAL;
+       }
+
        buffer[0] = reg;
        memcpy(&buffer[1], buf, len);