[PATCH] rtl28xxu: fix buffer overflow when probing Rafael Micro r820t tuner

[Gianluca Gennari <gennarone@gmail.com>]

req_r820t wants a buffer with a size of 5 bytes, but the buffer 'buf'
has a size of 2 bytes.

This patch fixes the kernel oops with the r820t driver on old kernels
during the probe stage.
Successfully tested on a 2.6.32 32 bit kernel (Ubuntu 10.04).
Hopefully it will also help with the random stability issues reported
by some user on the linux-media list.

This patch and https://patchwork.kernel.org/patch/2524651/
should go in the next 3.10-rc release, as they fix potential kernel crashes.

Signed-off-by: Gianluca Gennari <gennarone@gmail.com>
---
 drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 22015fe..48f2e6f 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -360,7 +360,7 @@ static int rtl2832u_read_config(struct dvb_usb_device *d)
 {
 	struct rtl28xxu_priv *priv = d_to_priv(d);
 	int ret;
-	u8 buf[2];
+	u8 buf[5];
 	/* open RTL2832U/RTL2832 I2C gate */
 	struct rtl28xxu_req req_gate_open = {0x0120, 0x0011, 0x0001, "\x18"};
 	/* close RTL2832U/RTL2832 I2C gate */
-- 
1.8.3