Merge remote-tracking branch 'lsk/v3.10/topic/configs' into linux-linaro-lsk

[firefly-linux-kernel-4.4.55.git] / drivers / media / dvb-frontends / zl10039.c

diff --git a/drivers/media/dvb-frontends/zl10039.c b/drivers/media/dvb-frontends/zl10039.c
index eff9c5fde50ad65662948cb9109341a0c25a7e0f..91b6b2e9b79228b6c497f7c7aba65dd36415f9da 100644 (file)
--- a/drivers/media/dvb-frontends/zl10039.c
+++ b/drivers/media/dvb-frontends/zl10039.c
@@ -30,6 +30,9 @@
 
 static int debug;
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 #define dprintk(args...) \
        do { \
                if (debug) \
@@ -98,7 +101,7 @@ static int zl10039_write(struct zl10039_state *state,
                        const enum zl10039_reg_addr reg, const u8 *src,
                        const size_t count)
 {
-       u8 buf[count + 1];
+       u8 buf[MAX_XFER_SIZE];
        struct i2c_msg msg = {
                .addr = state->i2c_addr,
                .flags = 0,
@@ -106,6 +109,13 @@ static int zl10039_write(struct zl10039_state *state,
                .len = count + 1,
        };
 
+       if (1 + count > sizeof(buf)) {
+               printk(KERN_WARNING
+                      "%s: i2c wr reg=%04x: len=%zd is too big!\n",
+                      KBUILD_MODNAME, reg, count);
+               return -EINVAL;
+       }
+
        dprintk("%s\n", __func__);
        /* Write register address and data in one go */
        buf[0] = reg;