From eabd93cee528fdc0aebe51ff93b6defd9a0a4e84 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab@redhat.com>
Date: Sat, 9 Jul 2011 18:57:54 -0300
Subject: [PATCH] --- yaml --- r: 261507 b: refs/heads/master c:
 bcd2ebb76039bf4b1d1cb9f9f0e182548578e692 h: refs/heads/master i:   261505:
 1ed892563b2c8256f8a57398b7dee0f01aa387d2   261503:
 884d53e7437824581c5ac2ecb5e01063b1280abe v: v3

---
 [refs]                                        | 2 +-
 trunk/drivers/media/dvb/frontends/drxk_hard.c | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 11e1654ca37c..40d8a675d4f2 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: e076c92ed6908b0a06ea0d419606a59cae7febe6
+refs/heads/master: bcd2ebb76039bf4b1d1cb9f9f0e182548578e692
diff --git a/trunk/drivers/media/dvb/frontends/drxk_hard.c b/trunk/drivers/media/dvb/frontends/drxk_hard.c
index c4b35a5638cd..89db37835872 100644
--- a/trunk/drivers/media/dvb/frontends/drxk_hard.c
+++ b/trunk/drivers/media/dvb/frontends/drxk_hard.c
@@ -1388,6 +1388,12 @@ static int DownloadMicrocode(struct drxk_state *state,
 		BlockCRC = (pSrc[0] << 8) | pSrc[1];
 		pSrc += sizeof(u16);
 		offset += sizeof(u16);
+
+		if (offset + BlockSize > Length) {
+			printk(KERN_ERR "drxk: Firmware is corrupted.\n");
+			return -EINVAL;
+		}
+
 		status = write_block(state, Address, BlockSize, pSrc);
 		if (status < 0)
 			break;