[media] cec: add sanity check for msg->len
authorHans Verkuil <hans.verkuil@cisco.com>
Tue, 12 Jul 2016 14:10:41 +0000 (11:10 -0300)
committerMauro Carvalho Chehab <mchehab@s-opensource.com>
Wed, 13 Jul 2016 10:58:12 +0000 (07:58 -0300)
Check (and warn) if the msg->len is too long or if it is 0.

Should never happen, but just in case...

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
drivers/staging/media/cec/cec-adap.c

index f184bf6945cc667a77ccd717527eba57a52a99a0..3925e0ae62a5b8247268726643f6f36fe350b409 100644 (file)
@@ -763,6 +763,9 @@ void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg)
        bool is_reply = false;
        bool valid_la = true;
 
+       if (WARN_ON(!msg->len || msg->len > CEC_MAX_MSG_SIZE))
+               return;
+
        mutex_lock(&adap->lock);
        msg->ts = ktime_get_ns();
        msg->rx_status = CEC_RX_STATUS_OK;