From 045344c3c1478f8d03a1a589d645fe10c3a23f77 Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Sun, 17 Jul 2016 05:16:40 -0300 Subject: [media] cec: zero unused msg part after msg->len Ensure that the unused part of the msg array is zeroed. This is required by CEC 2.0 when receiving shorter messages than expected. In that case the remaining bytes are assumed to be 0. There are no such CEC messages yet, but it is required to be future proof. And since we're doing it for received messages, do it for transmitted messages as well. It's unambiguous this way. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab diff --git a/drivers/staging/media/cec/cec-adap.c b/drivers/staging/media/cec/cec-adap.c index 2b34c0f..cd39a9a 100644 --- a/drivers/staging/media/cec/cec-adap.c +++ b/drivers/staging/media/cec/cec-adap.c @@ -601,6 +601,7 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, dprintk(1, "cec_transmit_msg: can't reply for poll msg\n"); return -EINVAL; } + memset(msg->msg + msg->len, 0, sizeof(msg->msg) - msg->len); if (msg->len == 1) { if (cec_msg_initiator(msg) != 0xf || cec_msg_destination(msg) == 0xf) { @@ -771,6 +772,7 @@ void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg) msg->tx_status = 0; msg->tx_ts = 0; msg->flags = 0; + memset(msg->msg + msg->len, 0, sizeof(msg->msg) - msg->len); mutex_lock(&adap->lock); dprintk(2, "cec_received_msg: %*ph\n", msg->len, msg->msg); -- cgit v0.10.2