Merge tag 'media/v6.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media updates from Mauro Carvalho Chehab:

 - New driver for Mediatek MDP V3

 - New driver for NXP i.MX DW100 dewarper

 - Zoran driver got promoted from staging

 - Hantro and related drivers got promoted from staging

 - Several VB1 drivers got moved to staging/deprecated (cpia2, fsl-viu,
   meye, saa7146, av7110, stkwebcam, tm6000, vpfe_capture, davinci,
   zr364xx)

 - Usual set of driver fixes, improvements and cleanups

* tag 'media/v6.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (107 commits)
  media: destage Hantro VPU driver
  media: platform: mtk-mdp3: add MediaTek MDP3 driver
  media: dt-binding: mediatek: add bindings for MediaTek CCORR and WDMA
  media: dt-binding: mediatek: add bindings for MediaTek MDP3 components
  media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
  media: xilinx: video: Add 1X12 greyscale format
  media: xilinx: csi2rxss: Add 1X12 greyscale format
  media: staging: media: imx: imx7-media-csi: Increase video mem limit
  media: uvcvideo: Limit power line control for Sonix Technology
  media: uvcvideo: Use entity get_cur in uvc_ctrl_set
  media: uvcvideo: Fix typo 'the the' in comment
  media: uvcvideo: Use indexed loops in uvc_ctrl_init_ctrl()
  media: uvcvideo: Fix memory leak in uvc_gpio_parse
  media: renesas: vsp1: Add support for RZ/G2L VSPD
  media: renesas: vsp1: Add VSP1_HAS_NON_ZERO_LBA feature bit
  media: renesas: vsp1: Add support for VSP software version
  media: renesas: vsp1: Add support to deassert/assert reset line
  media: dt-bindings: media: renesas,vsp1: Document RZ/G2L VSPD bindings
  media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start()
  media: amphion: fix a bug that vpu core may not resume after suspend
  ...

1 files changed, 2 insertions, 0 deletions

diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
index d99eedbdf011..200841c1f5cf 100644
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -964,6 +964,8 @@ static void tc358743_cec_handler(struct v4l2_subdev *sd, u16 intstatus,
 
 		v = i2c_rd32(sd, CECRCTR);
 		msg.len = v & 0x1f;
+		if (msg.len > CEC_MAX_MSG_SIZE)
+			msg.len = CEC_MAX_MSG_SIZE;
 		for (i = 0; i < msg.len; i++) {
 			v = i2c_rd32(sd, CECRBUF1 + i * 4);
 			msg.msg[i] = v & 0xff;