[bug report] [media] cec-funcs.h: static inlines to pack/unpack CEC messages

[bug report] [media] cec-funcs.h: static inlines to pack/unpack CEC messages

[Dan Carpenter]

Hello Hans Verkuil,

The patch 50f7d5a65e5a: "[media] cec-funcs.h: static inlines to
pack/unpack CEC messages" from Jun 17, 2016, leads to the following
static checker warning:

	include/linux/cec-funcs.h:1154 cec_ops_set_osd_string()
	warn: setting length 'msg->len - 3' to negative one

include/linux/cec-funcs.h
  1150  static inline void cec_ops_set_osd_string(const struct cec_msg *msg,
  1151                                            __u8 *disp_ctl,
  1152                                            char *osd)
  1153  {
  1154          unsigned int len = msg->len - 3;

The reason for this warning is that we know msg->len is at least 2 but
this code assumes it is at least 3.  There is a check in
cec_received_msg() which ensures that it is not <= 1.

  1155  
  1156          *disp_ctl = msg->msg[2];
  1157          if (len > 13)
  1158                  len = 13;
  1159          memcpy(osd, msg->msg + 3, len);
  1160          osd[len] = '\0';
  1161  }

regards,
dan carpenter