[media] dvb-frontends: Don't use dynamic static allocation

[sfrench/cifs-2.6.git] / drivers / media / dvb-frontends / bcm3510.c

diff --git a/drivers/media/dvb-frontends/bcm3510.c b/drivers/media/dvb-frontends/bcm3510.c
index 1b77909c0c7116c3cff03b6788912a29c2f240f3..39a29dd29519cba8573fd7ce1837e46d7df1f73b 100644 (file)
--- a/drivers/media/dvb-frontends/bcm3510.c
+++ b/drivers/media/dvb-frontends/bcm3510.c
@@ -44,6 +44,9 @@
 #include "bcm3510.h"
 #include "bcm3510_priv.h"
 
+/* Max transfer size done by bcm3510_do_hab_cmd() function */
+#define MAX_XFER_SIZE  128
+
 struct bcm3510_state {
 
        struct i2c_adapter* i2c;
@@ -201,9 +204,19 @@ static int bcm3510_hab_send_request(struct bcm3510_state *st, u8 *buf, int len)
 
 static int bcm3510_do_hab_cmd(struct bcm3510_state *st, u8 cmd, u8 msgid, u8 *obuf, u8 olen, u8 *ibuf, u8 ilen)
 {
-       u8 ob[olen+2],ib[ilen+2];
+       u8 ob[MAX_XFER_SIZE], ib[MAX_XFER_SIZE];
        int ret = 0;
 
+       if (ilen + 2 > sizeof(ib)) {
+               deb_hab("do_hab_cmd: ilen=%d is too big!\n", ilen);
+               return -EINVAL;
+       }
+
+       if (olen + 2 > sizeof(ob)) {
+               deb_hab("do_hab_cmd: olen=%d is too big!\n", olen);
+               return -EINVAL;
+       }
+
        ob[0] = cmd;
        ob[1] = msgid;
        memcpy(&ob[2],obuf,olen);