disable FB

hc

2024-01-04 1543e317f1da31b75942316931e8f491a8920811

 kernel/drivers/media/usb/dvb-usb/az6027.c
..
..
@@ -1,13 +1,10 @@
1
+// SPDX-License-Identifier: GPL-2.0-only
1
2
 /* DVB USB compliant Linux driver for the AZUREWAVE DVB-S/S2 USB2.0 (AZ6027)
2
3
  * receiver.
3
4
  *
4
5
  * Copyright (C) 2009 Adams.Xu <adams.xu@azwave.com.cn>
5
6
  *
6
- *	This program is free software; you can redistribute it and/or modify it
7
- *	under the terms of the GNU General Public License as published by the Free
8
- *	Software Foundation, version 2.
9
- *
10
- * see Documentation/media/dvb-drivers/dvb-usb.rst for more information
7
+ * see Documentation/driver-api/media/drivers/dvb-usb.rst for more information
11
8
  */
12
9
 #include "az6027.h"
13
10
 
..
..
@@ -978,6 +975,10 @@
978
975
 		if (msg[i].addr == 0x99) {
979
976
 			req = 0xBE;
980
977
 			index = 0;
978
+			if (msg[i].len < 1) {
979
+				i = -EOPNOTSUPP;
980
+				break;
981
+			}
981
982
 			value = msg[i].buf[0] & 0x00ff;
982
983
 			length = 1;
983
984
 			az6027_usb_out_op(d, req, value, index, data, length);
..
..
@@ -987,6 +988,10 @@
987
988
 			/* write/read request */
988
989
 			if (i + 1 < num && (msg[i + 1].flags & I2C_M_RD)) {
989
990
 				req = 0xB9;
991
+				if (msg[i].len < 1) {
992
+					i = -EOPNOTSUPP;
993
+					break;
994
+				}
990
995
 				index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff));
991
996
 				value = msg[i].addr + (msg[i].len << 8);
992
997
 				length = msg[i + 1].len + 6;
..
..
@@ -1000,6 +1005,10 @@
1000
1005
 
1001
1006
 				/* demod 16bit addr */
1002
1007
 				req = 0xBD;
1008
+				if (msg[i].len < 1) {
1009
+					i = -EOPNOTSUPP;
1010
+					break;
1011
+				}
1003
1012
 				index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff));
1004
1013
 				value = msg[i].addr + (2 << 8);
1005
1014
 				length = msg[i].len - 2;
..
..
@@ -1025,6 +1034,10 @@
1025
1034
 			} else {
1026
1035
 
1027
1036
 				req = 0xBD;
1037
+				if (msg[i].len < 1) {
1038
+					i = -EOPNOTSUPP;
1039
+					break;
1040
+				}
1028
1041
 				index = msg[i].buf[0] & 0x00FF;
1029
1042
 				value = msg[i].addr + (1 << 8);
1030
1043
 				length = msg[i].len - 1;
..
..
@@ -1055,8 +1068,8 @@
1055
1068
 };
1056
1069
 
1057
1070
 static int az6027_identify_state(struct usb_device *udev,
1058
-				 struct dvb_usb_device_properties *props,
1059
-				 struct dvb_usb_device_description **desc,
1071
+				 const struct dvb_usb_device_properties *props,
1072
+				 const struct dvb_usb_device_description **desc,
1060
1073
 				 int *cold)
1061
1074
 {
1062
1075
 	u8 *b;