Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 709d9208 authored by Antti Palosaari's avatar Antti Palosaari Committed by Mauro Carvalho Chehab
Browse files

[media] af9015: add more I2C msg checks 



Return EOPNOTSUPP for too long messages.

Signed-off-by: default avatarAntti Palosaari <crope@iki.fi>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 16b2dc2a

drivers/media/dvb/dvb-usb/af9015.c

+12 −0
Original line number Diff line number Diff line
@@ -292,6 +292,10 @@ Due to that the only way to select correct tuner is use demodulator I2C-gate. 
		}



		if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {

			if (msg[i].len > 3 || msg[i+1].len > 61) {

				ret = -EOPNOTSUPP;

				goto error;

			}

			if (msg[i].addr ==

				af9015_af9013_config[0].demod_address)

				req.cmd = READ_MEMORY;
@@ -306,6 +310,10 @@ Due to that the only way to select correct tuner is use demodulator I2C-gate. 
			ret = af9015_ctrl_msg(d, &req);

			i += 2;

		} else if (msg[i].flags & I2C_M_RD) {

			if (msg[i].len > 61) {

				ret = -EOPNOTSUPP;

				goto error;

			}

			if (msg[i].addr ==

				af9015_af9013_config[0].demod_address) {

				ret = -EINVAL;
@@ -321,6 +329,10 @@ Due to that the only way to select correct tuner is use demodulator I2C-gate. 
			ret = af9015_ctrl_msg(d, &req);

			i += 1;

		} else {

			if (msg[i].len > 21) {

				ret = -EOPNOTSUPP;

				goto error;

			}

			if (msg[i].addr ==

				af9015_af9013_config[0].demod_address)

				req.cmd = WRITE_MEMORY;