1 files changed, 9 insertions, 2 deletions

diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c
index e2fec9ebf947..93eeaf7118fd 100644
--- a/drivers/media/dvb-frontends/s5h1420.c
+++ b/drivers/media/dvb-frontends/s5h1420.c
@@ -836,9 +836,16 @@ static u32 s5h1420_tuner_i2c_func(struct i2c_adapter *adapter)
 static int s5h1420_tuner_i2c_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msg[], int num)
 {
         struct s5h1420_state *state = i2c_get_adapdata(i2c_adap);
-        struct i2c_msg m[1 + num];
+        struct i2c_msg m[3];
         u8 tx_open[2] = { CON_1, state->CON_1_val | 1 }; /* repeater stops once there was a stop condition */
 
+        if (1 + num > ARRAY_SIZE(m)) {
+                printk(KERN_WARNING
+                       "%s: i2c xfer: num=%d is too big!\n",
+                       KBUILD_MODNAME, num);
+                return  -EOPNOTSUPP;
+        }
+
         memset(m, 0, sizeof(struct i2c_msg) * (1 + num));
 
         m[0].addr = state->config->demod_address;
@@ -847,7 +854,7 @@ static int s5h1420_tuner_i2c_tuner_xfer(struct i2c_adapter *i2c_adap, struct i2c
 
         memcpy(&m[1], msg, sizeof(struct i2c_msg) * num);
 
-        return i2c_transfer(state->i2c, m, 1+num) == 1 + num ? num : -EIO;
+        return i2c_transfer(state->i2c, m, 1 + num) == 1 + num ? num : -EIO;
 }
 
 static struct i2c_algorithm s5h1420_tuner_i2c_algo = {