From 4aabd91625d0887210f68382f3fccb29a4586792 Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Tue, 11 Aug 2015 15:29:54 -0300 Subject: [PATCH] [media] horus3a: don't use variable length arrays The Linux stack is short; we need to be able to count the number of bytes used at stack on each function. So, we don't like to use variable-length arrays, as complained by smatch: drivers/media/dvb-frontends/horus3a.c:57:19: warning: Variable length array is used. The max usecase of the driver seems to be 5 bytes + 1 for the register. So, let's be safe and allocate 6 bytes for the write buffer. This should be enough to cover all cases. If not, let's print an error message. Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-frontends/horus3a.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/media/dvb-frontends/horus3a.c b/drivers/media/dvb-frontends/horus3a.c index 46a82dc586d8..5074305b289e 100644 --- a/drivers/media/dvb-frontends/horus3a.c +++ b/drivers/media/dvb-frontends/horus3a.c @@ -26,6 +26,8 @@ #include "horus3a.h" #include "dvb_frontend.h" +#define MAX_WRITE_REGSIZE 5 + enum horus3a_state { STATE_UNKNOWN, STATE_SLEEP, @@ -54,16 +56,22 @@ static int horus3a_write_regs(struct horus3a_priv *priv, u8 reg, const u8 *data, u32 len) { int ret; - u8 buf[len+1]; + u8 buf[MAX_WRITE_REGSIZE + 1]; struct i2c_msg msg[1] = { { .addr = priv->i2c_address, .flags = 0, - .len = sizeof(buf), + .len = len + 1, .buf = buf, } }; + if (len + 1 >= sizeof(buf)) { + dev_warn(&priv->i2c->dev,"wr reg=%04x: len=%d is too big!\n", + reg, len + 1); + return -E2BIG; + } + horus3a_i2c_debug(priv, reg, 1, data, len); buf[0] = reg; memcpy(&buf[1], data, len); -- 2.34.1