diff --git a/[refs] b/[refs]
index a9cacfdc9e83..733d403ce488 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: ef526f4246f566370218bb6e639f7549244ca5a2
+refs/heads/master: 6068f5063850984fe6c2490bc8384a7afa2728dc
diff --git a/trunk/drivers/media/dvb/dvb-core/dvb_frontend.c b/trunk/drivers/media/dvb/dvb-core/dvb_frontend.c
index bd59c9514ab5..f170e822fadc 100644
--- a/trunk/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/trunk/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -1344,7 +1344,7 @@ static int dvb_frontend_ioctl_properties(struct inode *inode, struct file *file,
 
 		/* Put an arbitrary limit on the number of messages that can
 		 * be sent at once */
-		if (tvps->num > DTV_IOCTL_MAX_MSGS)
+		if ((tvps->num == 0) || (tvps->num > DTV_IOCTL_MAX_MSGS))
 			return -EINVAL;
 
 		tvp = (struct dtv_property *) kmalloc(tvps->num *
@@ -1379,7 +1379,7 @@ static int dvb_frontend_ioctl_properties(struct inode *inode, struct file *file,
 
 		/* Put an arbitrary limit on the number of messages that can
 		 * be sent at once */
-		if (tvps->num > DTV_IOCTL_MAX_MSGS)
+		if ((tvps->num == 0) || (tvps->num > DTV_IOCTL_MAX_MSGS))
 			return -EINVAL;
 
 		tvp = (struct dtv_property *) kmalloc(tvps->num *