Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 52d802d6 authored by Hans Verkuil's avatar Hans Verkuil Committed by Mauro Carvalho Chehab
Browse files

[media] cec: add sanity check for msg->len 



Check (and warn) if the msg->len is too long or if it is 0.

Should never happen, but just in case...

Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent 0385443f

drivers/staging/media/cec/cec-adap.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -763,6 +763,9 @@ void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg) 
	bool is_reply = false;

	bool is_reply = false;

	bool valid_la = true;

	bool valid_la = true;





	if (WARN_ON(!msg->len || msg->len > CEC_MAX_MSG_SIZE))

		return;



	mutex_lock(&adap->lock);

	mutex_lock(&adap->lock);

	msg->ts = ktime_get_ns();

	msg->ts = ktime_get_ns();

	msg->rx_status = CEC_RX_STATUS_OK;

	msg->rx_status = CEC_RX_STATUS_OK;