diff options
Diffstat (limited to 'drivers/media/pci/cx23885/cimax2.c')
-rw-r--r-- | drivers/media/pci/cx23885/cimax2.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/drivers/media/pci/cx23885/cimax2.c b/drivers/media/pci/cx23885/cimax2.c index 7344849183a7..16fa7ea4d4aa 100644 --- a/drivers/media/pci/cx23885/cimax2.c +++ b/drivers/media/pci/cx23885/cimax2.c | |||
@@ -26,6 +26,10 @@ | |||
26 | #include "cx23885.h" | 26 | #include "cx23885.h" |
27 | #include "cimax2.h" | 27 | #include "cimax2.h" |
28 | #include "dvb_ca_en50221.h" | 28 | #include "dvb_ca_en50221.h" |
29 | |||
30 | /* Max transfer size done by I2C transfer functions */ | ||
31 | #define MAX_XFER_SIZE 64 | ||
32 | |||
29 | /**** Bit definitions for MC417_RWD and MC417_OEN registers *** | 33 | /**** Bit definitions for MC417_RWD and MC417_OEN registers *** |
30 | bits 31-16 | 34 | bits 31-16 |
31 | +-----------+ | 35 | +-----------+ |
@@ -125,7 +129,7 @@ static int netup_write_i2c(struct i2c_adapter *i2c_adap, u8 addr, u8 reg, | |||
125 | u8 *buf, int len) | 129 | u8 *buf, int len) |
126 | { | 130 | { |
127 | int ret; | 131 | int ret; |
128 | u8 buffer[len + 1]; | 132 | u8 buffer[MAX_XFER_SIZE]; |
129 | 133 | ||
130 | struct i2c_msg msg = { | 134 | struct i2c_msg msg = { |
131 | .addr = addr, | 135 | .addr = addr, |
@@ -134,6 +138,13 @@ static int netup_write_i2c(struct i2c_adapter *i2c_adap, u8 addr, u8 reg, | |||
134 | .len = len + 1 | 138 | .len = len + 1 |
135 | }; | 139 | }; |
136 | 140 | ||
141 | if (1 + len > sizeof(buffer)) { | ||
142 | printk(KERN_WARNING | ||
143 | "%s: i2c wr reg=%04x: len=%d is too big!\n", | ||
144 | KBUILD_MODNAME, reg, len); | ||
145 | return -EINVAL; | ||
146 | } | ||
147 | |||
137 | buffer[0] = reg; | 148 | buffer[0] = reg; |
138 | memcpy(&buffer[1], buf, len); | 149 | memcpy(&buffer[1], buf, len); |
139 | 150 | ||