Unverified Commit 54c43dd2 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14646 media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE 

Merge Pull Request from: @ci-robot 
 
PR sync from: Cai Xinchen <caixinchen1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/P24I6B67VES7KLDWGMEPC3FZNVGFI444/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBFBZR 
 
Link:https://gitee.com/openeuler/kernel/pulls/14646

 

Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents addfd0d3 006cd3f1

drivers/media/platform/s5p-cec/s5p_cec.c

+2 −0
Original line number Diff line number Diff line
@@ -116,6 +116,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv) 
				dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n");

			cec->rx = STATE_BUSY;

			cec->msg.len = status >> 24;

			if (cec->msg.len > CEC_MAX_MSG_SIZE)

				cec->msg.len = CEC_MAX_MSG_SIZE;

			cec->msg.rx_status = CEC_RX_STATUS_OK;

			s5p_cec_get_rx_buf(cec, cec->msg.len,

					cec->msg.msg);