[PATCH 2/6] em28xx: make sure the packet size is >= 4 before checking for headers in em28xx_urb_data_copy_vbi()

[Frank Schäfer <fschaefer.oss@xxxxxxxxxxxxxx>]

Signed-off-by: Frank Schäfer <fschaefer.oss@xxxxxxxxxxxxxx>
---
 drivers/media/usb/em28xx/em28xx-video.c |   45 ++++++++++++++++---------------
 1 Datei geändert, 24 Zeilen hinzugefügt(+), 21 Zeilen entfernt(-)

diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
index 7994d17..0bbc6dc 100644
--- a/drivers/media/usb/em28xx/em28xx-video.c
+++ b/drivers/media/usb/em28xx/em28xx-video.c
@@ -576,7 +576,7 @@ static inline int em28xx_urb_data_copy_vbi(struct em28xx *dev, struct urb *urb)
 			    urb->iso_frame_desc[i].offset;
 		}
 
-		if (actual_length <= 0) {
+		if (actual_length == 0) {
 			/* NOTE: happens very often with isoc transfers */
 			/* em28xx_usbdbg("packet %d is empty",i); - spammy */
 			continue;
@@ -585,27 +585,30 @@ static inline int em28xx_urb_data_copy_vbi(struct em28xx *dev, struct urb *urb)
 		/* capture type 0 = vbi start
 		   capture type 1 = video start
 		   capture type 2 = video in progress */
-		if (p[0] == 0x33 && p[1] == 0x95) {
-			dev->capture_type = 0;
-			dev->vbi_read = 0;
-			em28xx_usbdbg("VBI START HEADER!!!\n");
-			dev->cur_field = p[2];
-			p += 4;
-			len = actual_length - 4;
-		} else if (p[0] == 0x88 && p[1] == 0x88 &&
-			   p[2] == 0x88 && p[3] == 0x88) {
-			/* continuation */
-			p += 4;
-			len = actual_length - 4;
-		} else if (p[0] == 0x22 && p[1] == 0x5a) {
-			/* start video */
-			p += 4;
-			len = actual_length - 4;
-		} else {
-			/* NOTE: With bulk transfers, intermediate data packets
-			 * have no continuation header */
-			len = actual_length;
+		len = actual_length;
+		if (len >= 4) {
+			/* NOTE: headers are always 4 bytes and
+			 * never split across packets */
+			if (p[0] == 0x33 && p[1] == 0x95) {
+				dev->capture_type = 0;
+				dev->vbi_read = 0;
+				em28xx_usbdbg("VBI START HEADER!!!\n");
+				dev->cur_field = p[2];
+				p += 4;
+				len -= 4;
+			} else if (p[0] == 0x88 && p[1] == 0x88 &&
+				   p[2] == 0x88 && p[3] == 0x88) {
+				/* continuation */
+				p += 4;
+				len -= 4;
+			} else if (p[0] == 0x22 && p[1] == 0x5a) {
+				/* start video */
+				p += 4;
+				len -= 4;
+			}
 		}
+		/* NOTE: with bulk transfers, intermediate data packets
+		 * have no continuation header */
 
 		vbi_size = dev->vbi_width * dev->vbi_height;
 
-- 
1.7.10.4

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html