diff --git a/drivers/staging/media/lirc/lirc_zilog.c b/drivers/staging/media/lirc/lirc_zilog.c index 3259aacfd3501e95bc130a6479e620a4c8494598..0bf4bb3f0811019349e31c8ae410db915d94bf66 100644 --- a/drivers/staging/media/lirc/lirc_zilog.c +++ b/drivers/staging/media/lirc/lirc_zilog.c @@ -618,6 +618,7 @@ static int get_key_data(unsigned char *buf, for (base = 0, lim = keys - 1; lim; lim >>= 1) { /* Seek to block */ unsigned char *key_data; + pos = base + (lim >> 1); key_data = key_block + (ndiffs + 1) * pos; @@ -628,6 +629,7 @@ static int get_key_data(unsigned char *buf, /* found, so unpack the diffs */ for (i = 0; i < ndiffs; ++i) { unsigned char val; + if (!read_uint8(&key_data, endp, &val) || diffs[i] >= TX_BLOCK_SIZE) goto corrupt; @@ -656,6 +658,7 @@ static int send_data_block(struct IR_tx *tx, unsigned char *data_block) for (i = 0; i < TX_BLOCK_SIZE;) { int tosend = TX_BLOCK_SIZE - i; + if (tosend > 4) tosend = 4; buf[0] = (unsigned char)(i + 1); @@ -838,6 +841,7 @@ static int fw_load(struct IR_tx *tx) goto corrupt; for (i = 0; i < num_global_fixed; ++i) { unsigned char pos, val; + if (!read_uint8(&data, tx_data->endp, &pos) || !read_uint8(&data, tx_data->endp, &val) || pos >= TX_BLOCK_SIZE) @@ -1336,6 +1340,7 @@ static int close(struct inode *node, struct file *filep) { /* find our IR struct */ struct IR *ir = filep->private_data; + if (ir == NULL) { zilog_error("close: no private_data attached to the file!\n"); return -ENODEV; @@ -1402,6 +1407,7 @@ static int ir_remove(struct i2c_client *client) { if (strncmp("ir_tx_z8", client->name, 8) == 0) { struct IR_tx *tx = i2c_get_clientdata(client); + if (tx != NULL) { mutex_lock(&tx->client_lock); tx->c = NULL; @@ -1410,6 +1416,7 @@ static int ir_remove(struct i2c_client *client) } } else if (strncmp("ir_rx_z8", client->name, 8) == 0) { struct IR_rx *rx = i2c_get_clientdata(client); + if (rx != NULL) { mutex_lock(&rx->client_lock); rx->c = NULL;