[media] af9015: add more I2C msg checks

Return EOPNOTSUPP for too long messages.

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/media/dvb/dvb-usb/af9015.c b/drivers/media/dvb/dvb-usb/af9015.c
index 0bfe83b63e0168ae0ccc66688546c9e1464e5799..41a7c430f9c14561f781c46ddcbd889480fc8565 100644 (file)
--- a/drivers/media/dvb/dvb-usb/af9015.c
+++ b/drivers/media/dvb/dvb-usb/af9015.c
@@ -292,6 +292,10 @@ Due to that the only way to select correct tuner is use demodulator I2C-gate.
                }
 
                if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
+                       if (msg[i].len > 3 || msg[i+1].len > 61) {
+                               ret = -EOPNOTSUPP;
+                               goto error;
+                       }
                        if (msg[i].addr ==
                                af9015_af9013_config[0].demod_address)
                                req.cmd = READ_MEMORY;
@@ -306,6 +310,10 @@ Due to that the only way to select correct tuner is use demodulator I2C-gate.
                        ret = af9015_ctrl_msg(d, &req);
                        i += 2;
                } else if (msg[i].flags & I2C_M_RD) {
+                       if (msg[i].len > 61) {
+                               ret = -EOPNOTSUPP;
+                               goto error;
+                       }
                        if (msg[i].addr ==
                                af9015_af9013_config[0].demod_address) {
                                ret = -EINVAL;
@@ -321,6 +329,10 @@ Due to that the only way to select correct tuner is use demodulator I2C-gate.
                        ret = af9015_ctrl_msg(d, &req);
                        i += 1;
                } else {
+                       if (msg[i].len > 21) {
+                               ret = -EOPNOTSUPP;
+                               goto error;
+                       }
                        if (msg[i].addr ==
                                af9015_af9013_config[0].demod_address)
                                req.cmd = WRITE_MEMORY;