From: Antti Palosaari <crope@iki.fi>
Date: Sun, 1 Jul 2012 18:29:15 +0000 (-0300)
Subject: [media] tda10071: fix DiSEqC message len check
X-Git-Tag: firefly_0821_release~3680^2~275^2~1976
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=84431c2ae5e41dfcdba75e2f81e732664381cec9;p=firefly-linux-kernel-4.4.55.git

[media] tda10071: fix DiSEqC message len check

Message length check was wrong which could cause garbage sent to LNB,
but only in case garbage got from the userspace application.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
---

diff --git a/drivers/media/dvb/frontends/tda10071.c b/drivers/media/dvb/frontends/tda10071.c
index c21bc92d2811..3a1b6c0ac4ae 100644
--- a/drivers/media/dvb/frontends/tda10071.c
+++ b/drivers/media/dvb/frontends/tda10071.c
@@ -287,7 +287,7 @@ static int tda10071_diseqc_send_master_cmd(struct dvb_frontend *fe,
 
 	dbg("%s: msg_len=%d", __func__, diseqc_cmd->msg_len);
 
-	if (diseqc_cmd->msg_len < 3 || diseqc_cmd->msg_len > 16) {
+	if (diseqc_cmd->msg_len < 3 || diseqc_cmd->msg_len > 6) {
 		ret = -EINVAL;
 		goto error;
 	}