From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Date: Wed, 5 Nov 2014 11:34:12 +0000 (-0200)
Subject: [media] stb0899: don't go past DiSEqC msg buffer
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=b9f62ffe05e4019da205d6fec244226b191c5242;p=GitHub%2Fexynos8895%2Fandroid_kernel_samsung_universal8895.git

[media] stb0899: don't go past DiSEqC msg buffer

As reported by spatch:
	drivers/media/dvb-frontends/stb0899_drv.c:720 stb0899_send_diseqc_msg() error: buffer overflow 'cmd->msg' 6 <= 7

The buffer size is 6 and not 8. Anyway, the best is to use sizeof(),
to avoid such mistakes.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
---

diff --git a/drivers/media/dvb-frontends/stb0899_drv.c b/drivers/media/dvb-frontends/stb0899_drv.c
index 07cd5ea7a038..19646fbb061d 100644
--- a/drivers/media/dvb-frontends/stb0899_drv.c
+++ b/drivers/media/dvb-frontends/stb0899_drv.c
@@ -705,7 +705,7 @@ static int stb0899_send_diseqc_msg(struct dvb_frontend *fe, struct dvb_diseqc_ma
 	struct stb0899_state *state = fe->demodulator_priv;
 	u8 reg, i;
 
-	if (cmd->msg_len > 8)
+	if (cmd->msg_len > sizeof(cmd->msg))
 		return -EINVAL;
 
 	/* enable FIFO precharge	*/