[linux-dvb] [PATCH 4/6] DVB-Bt8xx: Check msg_len in cx24110_send_diseqc_msg

[Edgar Toernig]

The current diseq code only supports 3 to 6 byte messages
but never checks msg_len.  Apps trying to send longer
messages are overwriting reserved registers.

Return EINVAL for unsupported message lengths.

---

 cx24110.c |    3 +++
 1 files changed, 3 insertions(+)

--- linux-2.6.16/drivers/media/dvb/frontends/cx24110.c	2006-03-22 01:06:13 +0100
+++ linux-2.6.16/drivers/media/dvb/frontends/cx24110.c	2006-03-22 01:47:28 +0100
@@ -427,6 +427,9 @@ static int cx24110_send_diseqc_msg(struc
 	struct cx24110_state *state = fe->demodulator_priv;
 	unsigned long timeout;
 
+	if (cmd->msg_len < 3 || cmd->msg_len > 6)
+		return -EINVAL;  /* not implemented */
+
 	for (i = 0; i < cmd->msg_len; i++)
 		cx24110_writereg(state, 0x79 + i, cmd->msg[i]);