diff options
| -rw-r--r-- | linux/drivers/media/dvb/ttpci/av7110_ir.c | 21 |
1 files changed, 18 insertions, 3 deletions
diff --git a/linux/drivers/media/dvb/ttpci/av7110_ir.c b/linux/drivers/media/dvb/ttpci/av7110_ir.c index de1efcd24..3c4a30b8d 100644 --- a/linux/drivers/media/dvb/ttpci/av7110_ir.c +++ b/linux/drivers/media/dvb/ttpci/av7110_ir.c @@ -148,11 +148,26 @@ static int av7110_ir_write_proc (struct file *file, const char *buffer, unsigned long count, void *data) { - if (count < 4 + 256 * sizeof(u16)) + char *page; + int size = 4 + 256 * sizeof(u16); + + if (count < size) return -EINVAL; + + page = (char *)vmalloc(size); + if( NULL == page ) { + return -ENOMEM; + } - memcpy (&ir_config, buffer, 4); - memcpy (&key_map, buffer + 4, 256 * sizeof(u16)); + if (copy_from_user(page, buffer, size)) { + vfree(page); + return -EFAULT; + } + + memcpy (&ir_config, page, 4); + memcpy (&key_map, page + 4, 256 * sizeof(u16)); + + vfree(page); av7110_setup_irc_config (NULL, ir_config); |