Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 195c3ff6 authored by Hans Verkuil's avatar Hans Verkuil Committed by Greg Kroah-Hartman
Browse files

media: cros-ec-cec: limit msg.len to CEC_MAX_MSG_SIZE 



[ Upstream commit 2dc73b48665411a08c4e5f0f823dea8510761603 ]

I expect that the hardware will have limited this to 16, but just in
case it hasn't, check for this corner case.

Signed-off-by: default avatarHans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent a2728bf9

drivers/media/platform/cros-ec-cec/cros-ec-cec.c

+2 −0
Original line number Diff line number Diff line
@@ -44,6 +44,8 @@ static void handle_cec_message(struct cros_ec_cec *cros_ec_cec) 
	uint8_t *cec_message = cros_ec->event_data.data.cec_message;

	unsigned int len = cros_ec->event_size;



	if (len > CEC_MAX_MSG_SIZE)

		len = CEC_MAX_MSG_SIZE;

	cros_ec_cec->rx_msg.len = len;

	memcpy(cros_ec_cec->rx_msg.msg, cec_message, len);