The current diseq code only supports 3 to 6 byte messages but never checks msg_len. Apps trying to send longer messages are overwriting reserved registers. Return EINVAL for unsupported message lengths. --- cx24110.c | 3 +++ 1 files changed, 3 insertions(+) --- 0.4/drivers/media/dvb/frontends/cx24110.c Sat, 07 Jan 2006 01:12:16 +0100 froese (kernel-dvb/f/42_cx24110.c 1.3 644) +++ 0.5/drivers/media/dvb/frontends/cx24110.c Sat, 07 Jan 2006 20:21:12 +0100 froese (kernel-dvb/f/42_cx24110.c 1.4 644) @@ -428,6 +428,9 @@ struct cx24110_state *state = fe->demodulator_priv; unsigned long timeout; + if (cmd->msg_len < 3 || cmd->msg_len > 6) + return -EINVAL; /* not implemented */ + for (i = 0; i < cmd->msg_len; i++) cx24110_writereg(state, 0x79 + i, cmd->msg[i]);
