media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE

I expect that the hardware will have limited this to 16, but just in
case it hasn't, check for this corner case.

Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>

diff --git a/drivers/media/cec/platform/s5p/s5p_cec.c b/drivers/media/cec/platform/s5p/s5p_cec.c
index ce9a9d922f116c6f93b8106c846213a08982035f..0a30e7acdc10e98b96376e9ea55980a762d0abfd 100644 (file)
--- a/drivers/media/cec/platform/s5p/s5p_cec.c
+++ b/drivers/media/cec/platform/s5p/s5p_cec.c
@@ -115,6 +115,8 @@ static irqreturn_t s5p_cec_irq_handler(int irq, void *priv)
                                dev_dbg(cec->dev, "Buffer overrun (worker did not process previous message)\n");
                        cec->rx = STATE_BUSY;
                        cec->msg.len = status >> 24;
+                       if (cec->msg.len > CEC_MAX_MSG_SIZE)
+                               cec->msg.len = CEC_MAX_MSG_SIZE;
                        cec->msg.rx_status = CEC_RX_STATUS_OK;
                        s5p_cec_get_rx_buf(cec, cec->msg.len,
                                        cec->msg.msg);