diff options
| author | Hans Verkuil <hans.verkuil@cisco.com> | 2016-07-12 11:10:41 -0300 |
|---|---|---|
| committer | Ray Zhang <rayz@codeaurora.org> | 2017-05-25 11:21:58 +0800 |
| commit | 61423ca8a0913ff4dcd25ce593c5c384d66299e6 (patch) | |
| tree | f8f49be3ed12743a067ebfb1c38c5175234a24cd | |
| parent | 185a8562ea92b4f6eaed9e6c029cc411fc1a9caa (diff) | |
[media] cec: add sanity check for msg->len
Check (and warn) if the msg->len is too long or if it is 0.
Should never happen, but just in case...
Change-Id: I784aca0acdc74511b42b51ae01e57be0c04799b1
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Git-commit: 52d802d65b56a399aa67a9d3f26f232116d3e256
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
Signed-off-by: Ray Zhang <rayz@codeaurora.org>
| -rw-r--r-- | drivers/staging/media/cec/cec-adap.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/staging/media/cec/cec-adap.c b/drivers/staging/media/cec/cec-adap.c index f184bf6945cc..3925e0ae62a5 100644 --- a/drivers/staging/media/cec/cec-adap.c +++ b/drivers/staging/media/cec/cec-adap.c @@ -763,6 +763,9 @@ void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg) bool is_reply = false; bool valid_la = true; + if (WARN_ON(!msg->len || msg->len > CEC_MAX_MSG_SIZE)) + return; + mutex_lock(&adap->lock); msg->ts = ktime_get_ns(); msg->rx_status = CEC_RX_STATUS_OK; |