Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 63d171f8 authored by Hans Verkuil's avatar Hans Verkuil Committed by Mauro Carvalho Chehab
Browse files

media: cec: cec_transmit_msg_fh: do sanity checks first 



The code that fills in the CEC_MSG_CDC_MESSAGE physical address
is now done after the sanity checks. It also only does this if the
message length is >= 4 (i.e. there is room for the physical address).

Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+samsung@kernel.org>
parent 00ccd263

drivers/media/cec/cec-adap.c

+6 −5
Original line number Diff line number Diff line
@@ -740,11 +740,6 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, 
	else

		msg->flags = 0;



	if (msg->len > 1 && msg->msg[1] == CEC_MSG_CDC_MESSAGE) {

		msg->msg[2] = adap->phys_addr >> 8;

		msg->msg[3] = adap->phys_addr & 0xff;

	}



	/* Sanity checks */

	if (msg->len == 0 || msg->len > CEC_MAX_MSG_SIZE) {

		dprintk(1, "%s: invalid length %d\n", __func__, msg->len);
@@ -765,6 +760,12 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, 
		dprintk(1, "%s: can't reply to poll msg\n", __func__);

		return -EINVAL;

	}



	if (msg->len >= 4 && msg->msg[1] == CEC_MSG_CDC_MESSAGE) {

		msg->msg[2] = adap->phys_addr >> 8;

		msg->msg[3] = adap->phys_addr & 0xff;

	}



	if (msg->len == 1) {

		if (cec_msg_destination(msg) == 0xf) {

			dprintk(1, "%s: invalid poll message\n", __func__);