dw2102: Don't use dynamic static allocation

[pandora-kernel.git] / drivers / media / dvb / dvb-usb / dw2102.c

diff --git a/drivers/media/dvb/dvb-usb/dw2102.c b/drivers/media/dvb/dvb-usb/dw2102.c
index f103ec1..52f03f9 100644 (file)
--- a/drivers/media/dvb/dvb-usb/dw2102.c
+++ b/drivers/media/dvb/dvb-usb/dw2102.c
@@ -28,6 +28,9 @@
 #include "stb6100.h"
 #include "stb6100_proc.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 #ifndef USB_PID_DW2102
 #define USB_PID_DW2102 0x2102
 #endif
@@ -287,7 +290,14 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
        case 2: {
                /* read */
                /* first write first register number */
-               u8 ibuf[msg[1].len + 2], obuf[3];
+               u8 ibuf[MAX_XFER_SIZE], obuf[3];
+
+               if (2 + msg[1].len > sizeof(ibuf)) {
+                       warn("i2c rd: len=%d is too big!\n",
+                            msg[1].len);
+                       return -EOPNOTSUPP;
+               }
+
                obuf[0] = msg[0].addr << 1;
                obuf[1] = msg[0].len;
                obuf[2] = msg[0].buf[0];
@@ -304,7 +314,14 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
                switch (msg[0].addr) {
                case 0x68: {
                        /* write to register */
-                       u8 obuf[msg[0].len + 2];
+                       u8 obuf[MAX_XFER_SIZE];
+
+                       if (2 + msg[0].len > sizeof(obuf)) {
+                               warn("i2c wr: len=%d is too big!\n",
+                                    msg[1].len);
+                               return -EOPNOTSUPP;
+                       }
+
                        obuf[0] = msg[0].addr << 1;
                        obuf[1] = msg[0].len;
                        memcpy(obuf + 2, msg[0].buf, msg[0].len);
@@ -314,7 +331,14 @@ static int dw2102_earda_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg ms
                }
                case 0x61: {
                        /* write to tuner */
-                       u8 obuf[msg[0].len + 2];
+                       u8 obuf[MAX_XFER_SIZE];
+
+                       if (2 + msg[0].len > sizeof(obuf)) {
+                               warn("i2c wr: len=%d is too big!\n",
+                                    msg[1].len);
+                               return -EOPNOTSUPP;
+                       }
+
                        obuf[0] = msg[0].addr << 1;
                        obuf[1] = msg[0].len;
                        memcpy(obuf + 2, msg[0].buf, msg[0].len);
@@ -381,7 +405,14 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i
                default: {
                        if (msg[j].flags == I2C_M_RD) {
                                /* read registers */
-                               u8  ibuf[msg[j].len + 2];
+                               u8  ibuf[MAX_XFER_SIZE];
+
+                               if (2 + msg[j].len > sizeof(ibuf)) {
+                                       warn("i2c rd: len=%d is too big!\n",
+                                            msg[j].len);
+                                       return -EOPNOTSUPP;
+                               }
+
                                ret = dw210x_op_rw(d->udev, 0xc3,
                                                (msg[j].addr << 1) + 1, 0,
                                                ibuf, msg[j].len + 2,
@@ -410,7 +441,14 @@ static int dw2104_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], i
                                } while (len > 0);
                        } else {
                                /* write registers */
-                               u8 obuf[msg[j].len + 2];
+                               u8 obuf[MAX_XFER_SIZE];
+
+                               if (2 + msg[j].len > sizeof(obuf)) {
+                                       warn("i2c wr: len=%d is too big!\n",
+                                            msg[j].len);
+                                       return -EOPNOTSUPP;
+                               }
+
                                obuf[0] = msg[j].addr << 1;
                                obuf[1] = msg[j].len;
                                memcpy(obuf + 2, msg[j].buf, msg[j].len);
@@ -443,7 +481,13 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
        case 2: {
                /* read */
                /* first write first register number */
-               u8 ibuf[msg[1].len + 2], obuf[3];
+               u8 ibuf[MAX_XFER_SIZE], obuf[3];
+
+               if (2 + msg[1].len > sizeof(ibuf)) {
+                       warn("i2c rd: len=%d is too big!\n",
+                            msg[1].len);
+                       return -EOPNOTSUPP;
+               }
                obuf[0] = msg[0].addr << 1;
                obuf[1] = msg[0].len;
                obuf[2] = msg[0].buf[0];
@@ -461,7 +505,13 @@ static int dw3101_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
                case 0x60:
                case 0x0c: {
                        /* write to register */
-                       u8 obuf[msg[0].len + 2];
+                       u8 obuf[MAX_XFER_SIZE];
+
+                       if (2 + msg[0].len > sizeof(obuf)) {
+                               warn("i2c wr: len=%d is too big!\n",
+                                    msg[0].len);
+                               return -EOPNOTSUPP;
+                       }
                        obuf[0] = msg[0].addr << 1;
                        obuf[1] = msg[0].len;
                        memcpy(obuf + 2, msg[0].buf, msg[0].len);
@@ -544,7 +594,14 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
                default: {
                        if (msg[j].flags == I2C_M_RD) {
                                /* read registers */
-                               u8 ibuf[msg[j].len];
+                               u8 ibuf[MAX_XFER_SIZE];
+
+                               if (msg[j].len > sizeof(ibuf)) {
+                                       warn("i2c rd: len=%d is too big!\n",
+                                            msg[j].len);
+                                       return -EOPNOTSUPP;
+                               }
+
                                ret = dw210x_op_rw(d->udev, 0x91, 0, 0,
                                                ibuf, msg[j].len,
                                                DW210X_READ_MSG);
@@ -571,7 +628,14 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
                                } while (len > 0);
                        } else if (j < (num - 1)) {
                                /* write register addr before read */
-                               u8 obuf[msg[j].len + 2];
+                               u8 obuf[MAX_XFER_SIZE];
+
+                               if (2 + msg[j].len > sizeof(obuf)) {
+                                       warn("i2c wr: len=%d is too big!\n",
+                                            msg[j].len);
+                                       return -EOPNOTSUPP;
+                               }
+
                                obuf[0] = msg[j + 1].len;
                                obuf[1] = (msg[j].addr << 1);
                                memcpy(obuf + 2, msg[j].buf, msg[j].len);
@@ -583,7 +647,13 @@ static int s6x0_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],
                                break;
                        } else {
                                /* write registers */
-                               u8 obuf[msg[j].len + 2];
+                               u8 obuf[MAX_XFER_SIZE];
+
+                               if (2 + msg[j].len > sizeof(obuf)) {
+                                       warn("i2c wr: len=%d is too big!\n",
+                                            msg[j].len);
+                                       return -EOPNOTSUPP;
+                               }
                                obuf[0] = msg[j].len + 1;
                                obuf[1] = (msg[j].addr << 1);
                                memcpy(obuf + 2, msg[j].buf, msg[j].len);