aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/media/dvb-frontends/si21xx.c
diff options
context:
space:
mode:
authorMauro Carvalho Chehab <mchehab@osg.samsung.com>2014-10-09 17:00:54 (GMT)
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>2014-10-09 17:00:54 (GMT)
commita66d05d504a24894a8fdf11e4569752f313e5764 (patch)
tree2bb40c1f6c301b231d7aeaad08c190aa5a82ba1f /drivers/media/dvb-frontends/si21xx.c
parentbfe01a5ba2490f299e1d2d5508cbbbadd897bbe9 (diff)
parent5563caaf8b8cd22e35997d5d74cb3609df86b223 (diff)
Merge branch 'patchwork' into v4l_for_linusmedia/v3.18-rc1
* patchwork: (544 commits) [media] ir-hix5hd2: fix build on c6x arch [media] pt3: fix DTV FE I2C driver load error paths Revert "[media] media: em28xx - remove reset_resume interface" [media] exynos4-is: fix some warnings when compiling on arm64 [media] usb drivers: use %zu instead of %zd [media] pci drivers: use %zu instead of %zd [media] dvb-frontends: use %zu instead of %zd [media] s5p-mfc: Fix several printk warnings [media] s5p_mfc_opr: Fix warnings [media] ti-vpe: Fix typecast [media] s3c-camif: fix dma_addr_t printks [media] s5p_mfc_opr_v6: get rid of warnings when compiled with 64 bits [media] s5p_mfc_opr_v5: Fix lots of warnings on x86_64 [media] em28xx: Fix identation [media] drxd: remove a dead code [media] saa7146: remove return after BUG() [media] cx88: remove return after BUG() [media] cx88: fix cards table CodingStyle [media] radio-sf16fmr2: declare some structs as static [media] radio-sf16fmi: declare pnp_attached as static ... Conflicts: Documentation/DocBook/media/v4l/compat.xml
Diffstat (limited to 'drivers/media/dvb-frontends/si21xx.c')
-rw-r--r--drivers/media/dvb-frontends/si21xx.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/media/dvb-frontends/si21xx.c b/drivers/media/dvb-frontends/si21xx.c
index 73b47cc..16850e2 100644
--- a/drivers/media/dvb-frontends/si21xx.c
+++ b/drivers/media/dvb-frontends/si21xx.c
@@ -236,6 +236,9 @@ static int si21_writeregs(struct si21xx_state *state, u8 reg1,
.len = len + 1
};
+ if (len > sizeof(buf) - 1)
+ return -EINVAL;
+
msg.buf[0] = reg1;
memcpy(msg.buf + 1, data, len);

Privacy Policy