diff options
Diffstat (limited to 'drivers/media/tuners/si2157.c')
| -rw-r--r-- | drivers/media/tuners/si2157.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c index cf97142e01e6..446917439ae5 100644 --- a/drivers/media/tuners/si2157.c +++ b/drivers/media/tuners/si2157.c @@ -157,6 +157,11 @@ static int si2157_init(struct dvb_frontend *fe) for (remaining = fw->size; remaining > 0; remaining -= 17) { len = fw->data[fw->size - remaining]; + if (len > SI2157_ARGLEN) { + dev_err(&s->client->dev, "Bad firmware length\n"); + ret = -EINVAL; + goto err; + } memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len); cmd.wlen = len; cmd.rlen = 1; |