From: Hans Verkuil <hans.verkuil@xxxxxxxxx>
drivers/media/dvb-frontends/hd29l2.c:29:18: warning: Variable length array is used.
drivers/media/dvb-frontends/hd29l2.c:34:32: error: cannot size expression
drivers/media/dvb-frontends/hd29l2.c:125:5: warning: symbol 'hd29l2_rd_reg_mask' was not declared. Should it be static?
Variable length arrays are frowned upon, so replace with a fixed length and check
that there won't be a buffer overrun.
Signed-off-by: Hans Verkuil <hans.verkuil@xxxxxxxxx>
Cc: Antti Palosaari <crope@xxxxxx>
---
drivers/media/dvb-frontends/hd29l2.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/media/dvb-frontends/hd29l2.c b/drivers/media/dvb-frontends/hd29l2.c
index d7b9d54..67c8e6d 100644
--- a/drivers/media/dvb-frontends/hd29l2.c
+++ b/drivers/media/dvb-frontends/hd29l2.c
@@ -22,20 +22,24 @@
#include "hd29l2_priv.h"
+#define HD29L2_MAX_LEN (3)
+
/* write multiple registers */
static int hd29l2_wr_regs(struct hd29l2_priv *priv, u8 reg, u8 *val, int len)
{
int ret;
- u8 buf[2 + len];
+ u8 buf[2 + HD29L2_MAX_LEN];
struct i2c_msg msg[1] = {
{
.addr = priv->cfg.i2c_addr,
.flags = 0,
- .len = sizeof(buf),
+ .len = 2 + len,
.buf = buf,
}
};
+ if (len > HD29L2_MAX_LEN)
+ return -EINVAL;
buf[0] = 0x00;
buf[1] = reg;
memcpy(&buf[2], val, len);
@@ -118,7 +122,7 @@ static int hd29l2_wr_reg_mask(struct hd29l2_priv *priv, u8 reg, u8 val, u8 mask)
}
/* read single register with mask */
-int hd29l2_rd_reg_mask(struct hd29l2_priv *priv, u8 reg, u8 *val, u8 mask)
+static int hd29l2_rd_reg_mask(struct hd29l2_priv *priv, u8 reg, u8 *val, u8 mask)
{
int ret, i;
u8 tmp;
--
2.1.3
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
