diff options
| author | Hans Verkuil <hverkuil-cisco@xs4all.nl> | 2022-08-24 09:00:24 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@kernel.org> | 2022-08-30 07:37:24 +0200 |
| commit | 3028fb90f5b972ef9b9e68e75a8372b8f9a8e312 (patch) | |
| tree | 22725baf87ffa05b50930268c15b7f72e62a24cf /drivers/media/i2c/tc358743.c | |
| parent | media: media/cec: use CEC_MAX_MSG_SIZE instead of hardcoded 16 (diff) | |
| download | linux-3028fb90f5b972ef9b9e68e75a8372b8f9a8e312.tar.xz linux-3028fb90f5b972ef9b9e68e75a8372b8f9a8e312.zip | |
media: tc358743: limit msg.len to CEC_MAX_MSG_SIZE
I expect that the hardware will have limited this to 16, but just in
case it hasn't, check for this corner case.
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Diffstat (limited to 'drivers/media/i2c/tc358743.c')
| -rw-r--r-- | drivers/media/i2c/tc358743.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c index e18b8947ad7e..804b8ee8e4ab 100644 --- a/drivers/media/i2c/tc358743.c +++ b/drivers/media/i2c/tc358743.c @@ -964,6 +964,8 @@ static void tc358743_cec_handler(struct v4l2_subdev *sd, u16 intstatus, v = i2c_rd32(sd, CECRCTR); msg.len = v & 0x1f; + if (msg.len > CEC_MAX_MSG_SIZE) + msg.len = CEC_MAX_MSG_SIZE; for (i = 0; i < msg.len; i++) { v = i2c_rd32(sd, CECRBUF1 + i * 4); msg.msg[i] = v & 0xff; |