1 files changed, 11 insertions, 1 deletions
diff --git a/drivers/media/dvb-frontends/stv090x.c b/drivers/media/dvb-frontends/stv090x.c
index 56d470ad5a82..23e872f84742 100644
--- a/drivers/media/dvb-frontends/stv090x.c
+++ b/drivers/media/dvb-frontends/stv090x.c
@@ -35,6 +35,9 @@
 #include "stv090x.h"
 #include "stv090x_priv.h"
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
 static unsigned int verbose;
 module_param(verbose, int, 0644);
@@ -722,9 +725,16 @@ static int stv090x_write_regs(struct stv090x_state *state, unsigned int reg, u8
 {
        const struct stv090x_config *config = state->config;
        int ret;
-        u8 buf[2 + count];
+        u8 buf[MAX_XFER_SIZE];
        struct i2c_msg i2c_msg = { .addr = config->address, .flags = 0, .buf = buf, .len = 2 + count };
+        if (2 + count > sizeof(buf)) {
+                printk(KERN_WARNING
+                       "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                       KBUILD_MODNAME, reg, count);
+                return -EINVAL;
+        }
        buf[0] = reg >> 8;
        buf[1] = reg & 0xff;
        memcpy(&buf[2], data, count);