summaryrefslogtreecommitdiffstats
path: root/drivers/media/dvb-frontends
diff options
context:
space:
mode:
authorMauro Carvalho Chehab <mchehab@osg.samsung.com>2015-08-11 15:29:54 -0300
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>2015-08-11 15:41:23 -0300
commit4aabd91625d0887210f68382f3fccb29a4586792 (patch)
tree1a950da617bb1ae8e83598f4f3c0563ec9b0a743 /drivers/media/dvb-frontends
parentd13a7b674af085eb67df73a20f5cc77310dd8602 (diff)
downloadlinux-4aabd91625d0887210f68382f3fccb29a4586792.tar.gz
linux-4aabd91625d0887210f68382f3fccb29a4586792.tar.bz2
linux-4aabd91625d0887210f68382f3fccb29a4586792.zip
[media] horus3a: don't use variable length arrays
The Linux stack is short; we need to be able to count the number of bytes used at stack on each function. So, we don't like to use variable-length arrays, as complained by smatch: drivers/media/dvb-frontends/horus3a.c:57:19: warning: Variable length array is used. The max usecase of the driver seems to be 5 bytes + 1 for the register. So, let's be safe and allocate 6 bytes for the write buffer. This should be enough to cover all cases. If not, let's print an error message. Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Diffstat (limited to 'drivers/media/dvb-frontends')
-rw-r--r--drivers/media/dvb-frontends/horus3a.c12
1 files changed, 10 insertions, 2 deletions
diff --git a/drivers/media/dvb-frontends/horus3a.c b/drivers/media/dvb-frontends/horus3a.c
index 46a82dc586d8..5074305b289e 100644
--- a/drivers/media/dvb-frontends/horus3a.c
+++ b/drivers/media/dvb-frontends/horus3a.c
@@ -26,6 +26,8 @@
#include "horus3a.h"
#include "dvb_frontend.h"
+#define MAX_WRITE_REGSIZE 5
+
enum horus3a_state {
STATE_UNKNOWN,
STATE_SLEEP,
@@ -54,16 +56,22 @@ static int horus3a_write_regs(struct horus3a_priv *priv,
u8 reg, const u8 *data, u32 len)
{
int ret;
- u8 buf[len+1];
+ u8 buf[MAX_WRITE_REGSIZE + 1];
struct i2c_msg msg[1] = {
{
.addr = priv->i2c_address,
.flags = 0,
- .len = sizeof(buf),
+ .len = len + 1,
.buf = buf,
}
};
+ if (len + 1 >= sizeof(buf)) {
+ dev_warn(&priv->i2c->dev,"wr reg=%04x: len=%d is too big!\n",
+ reg, len + 1);
+ return -E2BIG;
+ }
+
horus3a_i2c_debug(priv, reg, 1, data, len);
buf[0] = reg;
memcpy(&buf[1], data, len);