diff options
author | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2014-12-04 11:48:42 -0500 |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2014-12-04 12:28:46 -0500 |
commit | ffe300107d931c5cde5383db420b90e856db84ed (patch) | |
tree | 20d2209a373f3bffd39ecd8d47f730c8dab486f0 /drivers/media/dvb-frontends/stv090x.c | |
parent | b769ef69d0b07af98979431a562709c768363d34 (diff) |
[media] stv090x: add an extra protetion against buffer overflow
As pointed by smatch:
drivers/media/dvb-frontends/stv090x.c:2787 stv090x_optimize_carloop() error: buffer overflow 'car_loop_apsk_low' 11 <= 13
drivers/media/dvb-frontends/stv090x.c:2789 stv090x_optimize_carloop() error: buffer overflow 'car_loop_apsk_low' 11 <= 13
drivers/media/dvb-frontends/stv090x.c:2791 stv090x_optimize_carloop() error: buffer overflow 'car_loop_apsk_low' 11 <= 13
drivers/media/dvb-frontends/stv090x.c:2793 stv090x_optimize_carloop() error: buffer overflow 'car_loop_apsk_low' 11 <= 13
drivers/media/dvb-frontends/stv090x.c:2795 stv090x_optimize_carloop() error: buffer overflow 'car_loop_apsk_low' 11 <= 13
The situation of a buffer overflow won't happen, in practice,
with the current values of car_loop table. Yet, the entire logic
that checks for those registration values is too complex. So,
better to add an explicit check, just in case someone changes
the car_loop tables causing a buffer overflow by mistake.
This also helps to remove several smatch warnings, with is good.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Diffstat (limited to 'drivers/media/dvb-frontends/stv090x.c')
-rw-r--r-- | drivers/media/dvb-frontends/stv090x.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/media/dvb-frontends/stv090x.c b/drivers/media/dvb-frontends/stv090x.c index bce9cc1072aa..0b2a934f53e5 100644 --- a/drivers/media/dvb-frontends/stv090x.c +++ b/drivers/media/dvb-frontends/stv090x.c | |||
@@ -2783,6 +2783,12 @@ static u8 stv090x_optimize_carloop(struct stv090x_state *state, enum stv090x_mod | |||
2783 | aclc = car_loop[i].crl_pilots_off_30; | 2783 | aclc = car_loop[i].crl_pilots_off_30; |
2784 | } | 2784 | } |
2785 | } else { /* 16APSK and 32APSK */ | 2785 | } else { /* 16APSK and 32APSK */ |
2786 | /* | ||
2787 | * This should never happen in practice, except if | ||
2788 | * something is really wrong at the car_loop table. | ||
2789 | */ | ||
2790 | if (i >= 11) | ||
2791 | i = 10; | ||
2786 | if (state->srate <= 3000000) | 2792 | if (state->srate <= 3000000) |
2787 | aclc = car_loop_apsk_low[i].crl_pilots_on_2; | 2793 | aclc = car_loop_apsk_low[i].crl_pilots_on_2; |
2788 | else if (state->srate <= 7000000) | 2794 | else if (state->srate <= 7000000) |