Check (and warn) if the msg->len is too long or if it is 0. Should never happen, but just in case... Signed-off-by: Hans Verkuil <hans.verkuil@xxxxxxxxx> --- drivers/staging/media/cec/cec-adap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/staging/media/cec/cec-adap.c b/drivers/staging/media/cec/cec-adap.c index 2cd656b..936df93 100644 --- a/drivers/staging/media/cec/cec-adap.c +++ b/drivers/staging/media/cec/cec-adap.c @@ -759,6 +759,9 @@ void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg) bool is_reply = false; bool valid_la = true; + if (WARN_ON(!msg->len || msg->len > CEC_MAX_MSG_SIZE)) + return; + mutex_lock(&adap->lock); msg->ts = ktime_get_ns(); msg->rx_status = CEC_RX_STATUS_OK; -- 2.7.0 -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
