[linux-dvb] [PATCH 4/6] DVB-PinnSat: Check msg_len in cx24110_send_diseqc_msg

[Edgar Toernig]

The current diseq code only supports 3 to 6 byte messages
but never checks msg_len.  Apps trying to send longer
messages are overwriting reserved registers.

Return EINVAL for unsupported message lengths.

---

 cx24110.c |    3 +++
 1 files changed, 3 insertions(+)

--- 0.4/drivers/media/dvb/frontends/cx24110.c Sat, 07 Jan 2006 01:12:16 +0100 froese (kernel-dvb/f/42_cx24110.c 1.3 644)
+++ 0.5/drivers/media/dvb/frontends/cx24110.c Sat, 07 Jan 2006 20:21:12 +0100 froese (kernel-dvb/f/42_cx24110.c 1.4 644)
@@ -428,6 +428,9 @@
 	struct cx24110_state *state = fe->demodulator_priv;
 	unsigned long timeout;
 
+	if (cmd->msg_len < 3 || cmd->msg_len > 6)
+		return -EINVAL;  /* not implemented */
+
 	for (i = 0; i < cmd->msg_len; i++)
 		cx24110_writereg(state, 0x79 + i, cmd->msg[i]);