[lvc-project] [PATCH 6.1/6.12] media: ec168: fix slab-out-of-bounds in ec168_i2c_xfer

[Fedor Pchelkin]

On Fri, 29. May 18:37, Viktoriya Danchenko wrote:
> diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-usb-v2/ec168.c
> index 0e4773fc025c..4bac5ab72c2c 100644
> --- a/drivers/media/usb/dvb-usb-v2/ec168.c
> +++ b/drivers/media/usb/dvb-usb-v2/ec168.c
> @@ -135,7 +135,7 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
>  			}
>  		} else {
>  			if (msg[i].addr == ec168_ec100_config.demod_address) {
> -				if (msg[i].len < 1) {
> +				if (msg[i].len < 2) {

В else-ветке на десяток строк ниже аналогичная проблема.  Имеет смысл
исправить в том же патче.

>  					i = -EOPNOTSUPP;
>  					break;
>  				}
> -- 
> 2.43.0