Check (and warn) if the msg->len is too long or if it is 0.
Should never happen, but just in case...
Signed-off-by: Hans Verkuil <hans.verk...@cisco.com>
---
drivers/staging/media/cec/cec-adap.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/staging/media/cec/cec-adap.c
b/drivers/staging/media/cec/cec-adap.c
index 2cd656b..936df93 100644
--- a/drivers/staging/media/cec/cec-adap.c
+++ b/drivers/staging/media/cec/cec-adap.c
@@ -759,6 +759,9 @@ void cec_received_msg(struct cec_adapter *adap, struct
cec_msg *msg)
bool is_reply = false;
bool valid_la = true;
+ if (WARN_ON(!msg->len || msg->len > CEC_MAX_MSG_SIZE))
+ return;
+
mutex_lock(&adap->lock);
msg->ts = ktime_get_ns();
msg->rx_status = CEC_RX_STATUS_OK;
--
2.7.0
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
