diff options
| author | Otavio Salvador <otavio@ossystems.com.br> | 2019-07-15 11:15:02 -0300 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-07-15 11:15:02 -0300 |
| commit | 6b774eec1f9d3064e9b33634dfa99d5666d0a73a (patch) | |
| tree | 64fa879c312d6a52f90e6dbf3f7be2d66de3ddd4 /drivers/media/radio | |
| parent | 774f42075a4800fe4106dffca804e3207bc3c2e7 (diff) | |
| parent | 286d8c46ed06d5fc1b8c212356a11a19b2c94bc4 (diff) | |
Merge pull request #50 from MaxKrummenacher/4.14-2.0.x-imx
4.14 2.0.x imx
Diffstat (limited to 'drivers/media/radio')
| -rw-r--r-- | drivers/media/radio/wl128x/fmdrv_common.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index ab3428bf63fe..26895ae42fcf 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -489,7 +489,8 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload, return -EIO; } /* Send response data to caller */ - if (response != NULL && response_len != NULL && evt_hdr->dlen) { + if (response != NULL && response_len != NULL && evt_hdr->dlen && + evt_hdr->dlen <= payload_len) { /* Skip header info and copy only response data */ skb_pull(skb, sizeof(struct fm_event_msg_hdr)); memcpy(response, skb->data, evt_hdr->dlen); @@ -583,6 +584,8 @@ static void fm_irq_handle_flag_getcmd_resp(struct fmdev *fmdev) return; fm_evt_hdr = (void *)skb->data; + if (fm_evt_hdr->dlen > sizeof(fmdev->irq_info.flag)) + return; /* Skip header info and copy only response data */ skb_pull(skb, sizeof(struct fm_event_msg_hdr)); @@ -1308,7 +1311,7 @@ static int load_default_rx_configuration(struct fmdev *fmdev) static int fm_power_up(struct fmdev *fmdev, u8 mode) { u16 payload; - __be16 asic_id, asic_ver; + __be16 asic_id = 0, asic_ver = 0; int resp_len, ret; u8 fw_name[50]; |