4 files changed, 35 insertions, 14 deletions

diff --git a/drivers/media/dvb/ttpci/Kconfig b/drivers/media/dvb/ttpci/Kconfig
index d4339b1b3b68..07643e010093 100644
--- a/drivers/media/dvb/ttpci/Kconfig
+++ b/drivers/media/dvb/ttpci/Kconfig
@@ -101,6 +101,7 @@ config DVB_BUDGET
 config DVB_BUDGET_CI
         tristate "Budget cards with onboard CI connector"
         depends on DVB_BUDGET_CORE && I2C
+        depends on INPUT # due to IR
         select DVB_STV0297 if !DVB_FE_CUSTOMISE
         select DVB_STV0299 if !DVB_FE_CUSTOMISE
         select DVB_TDA1004X if !DVB_FE_CUSTOMISE
diff --git a/drivers/media/dvb/ttpci/av7110.c b/drivers/media/dvb/ttpci/av7110.c
index 747e7f1a6267..f05d43d8b5cf 100644
--- a/drivers/media/dvb/ttpci/av7110.c
+++ b/drivers/media/dvb/ttpci/av7110.c
@@ -51,6 +51,7 @@
 #include <linux/crc32.h>
 #include <linux/i2c.h>
 #include <linux/kthread.h>
+#include <asm/unaligned.h>
 
 #include <asm/system.h>
 
@@ -1461,9 +1462,9 @@ static int check_firmware(struct av7110* av7110)
         ptr += 4;
 
         /* check dpram file */
-        crc = ntohl(*(u32*) ptr);
+        crc = get_unaligned_be32(ptr);
         ptr += 4;
-        len = ntohl(*(u32*) ptr);
+        len = get_unaligned_be32(ptr);
         ptr += 4;
         if (len >= 512) {
                 printk("dvb-ttpci: dpram file is way too big.\n");
@@ -1478,9 +1479,9 @@ static int check_firmware(struct av7110* av7110)
         ptr += len;
 
         /* check root file */
-        crc = ntohl(*(u32*) ptr);
+        crc = get_unaligned_be32(ptr);
         ptr += 4;
-        len = ntohl(*(u32*) ptr);
+        len = get_unaligned_be32(ptr);
         ptr += 4;
 
         if (len <= 200000 || len >= 300000 ||
diff --git a/drivers/media/dvb/ttpci/av7110_av.c b/drivers/media/dvb/ttpci/av7110_av.c
index 3e6b650fbb81..ec55a968f204 100644
--- a/drivers/media/dvb/ttpci/av7110_av.c
+++ b/drivers/media/dvb/ttpci/av7110_av.c
@@ -965,8 +965,9 @@ static u8 iframe_header[] = { 0x00, 0x00, 0x01, 0xe0, 0x00, 0x00, 0x80, 0x00, 0x
 
 static int play_iframe(struct av7110 *av7110, char __user *buf, unsigned int len, int nonblock)
 {
-        int i, n;
+        unsigned i, n;
         int progressive = 0;
+        int match = 0;
 
         dprintk(2, "av7110:%p, \n", av7110);
 
@@ -975,12 +976,31 @@ static int play_iframe(struct av7110 *av7110, char __user *buf, unsigned int len
                         return -EBUSY;
         }
 
-        for (i = 0; i < len - 5; i++) {
-                /* get progressive flag from picture extension */
-                if (buf[i] == 0x00 && buf[i+1] == 0x00 &&
-                    buf[i+2] == 0x01 && (unsigned char)buf[i+3] == 0xb5 &&
-                    (buf[i+4] & 0xf0) == 0x10)
-                        progressive = buf[i+5] & 0x08;
+        /* search in buf for instances of 00 00 01 b5 1? */
+        for (i = 0; i < len; i++) {
+                unsigned char c;
+                if (get_user(c, buf + i))
+                        return -EFAULT;
+                if (match == 5) {
+                        progressive = c & 0x08;
+                        match = 0;
+                }
+                if (c == 0x00) {
+                        match = (match == 1 || match == 2) ? 2 : 1;
+                        continue;
+                }
+                switch (match++) {
+                case 2: if (c == 0x01)
+                                continue;
+                        break;
+                case 3: if (c == 0xb5)
+                                continue;
+                        break;
+                case 4: if ((c & 0xf0) == 0x10)
+                                continue;
+                        break;
+                }
+                match = 0;
         }
 
         /* setting n always > 1, fixes problems when playing stillframes
diff --git a/drivers/media/dvb/ttpci/av7110_hw.c b/drivers/media/dvb/ttpci/av7110_hw.c
index 9d81074b31df..3a3f5279e927 100644
--- a/drivers/media/dvb/ttpci/av7110_hw.c
+++ b/drivers/media/dvb/ttpci/av7110_hw.c
@@ -427,6 +427,7 @@ static int __av7110_send_fw_cmd(struct av7110 *av7110, u16* buf, int length)
                         if (err) {
                                 printk(KERN_ERR "%s: timeout waiting on busy %s QUEUE\n",
                                         __func__, type);
+                                av7110->arm_errors++;
                                 return -ETIMEDOUT;
                         }
                         msleep(1);
@@ -853,10 +854,8 @@ static osd_raw_window_t bpp2bit[8] = {
 
 static inline int WaitUntilBmpLoaded(struct av7110 *av7110)
 {
-        int ret = wait_event_interruptible_timeout(av7110->bmpq,
+        int ret = wait_event_timeout(av7110->bmpq,
                                 av7110->bmp_state != BMP_LOADING, 10*HZ);
-        if (ret == -ERESTARTSYS)
-                return ret;
         if (ret == 0) {
                 printk("dvb-ttpci: warning: timeout waiting in LoadBitmap: %d, %d\n",
                        ret, av7110->bmp_state);