Wei Chen 858e97d795 media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
In az6027_i2c_xfer, msg is controlled by user. When msg[i].buf is null,
commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in
az6027_i2c_xfer()") fix the null-ptr-deref bug when msg[i].addr is 0x99.
However, null-ptr-deref also happens when msg[i].addr is 0xd0 and 0xc0.
We add check on msg[i].len to prevent null-ptr-deref.

Link: https://lore.kernel.org/linux-media/20230310165604.3093483-1-harperchen1110@gmail.com
Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
2023-05-14 06:29:42 +01:00
..
2017-11-15 20:30:12 -08:00
2022-03-18 05:58:35 +01:00
2021-06-02 11:16:15 +02:00