V4L/DVB (3704): Fix some errors on bttv_risc_overlay

There are tree mistakes on bttv_risc_overlay.
1) When skip_odd is true, the number of lines for which
instructions are written is (height+1)/2, not height/2.
2) This occurs when clipping: the number of instruction bytes
written can be as much as 8 + 12*nclips, not 8 + 8*nclips, as
currently estimated.
3) Coverity check were wrong with nskips=0, since it means that
it can clipped at most one line.

Signed-off-by: Duncan Sands <baldrick@free.fr>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 6 insertions, 8 deletions

diff --git a/drivers/media/video/bt8xx/bttv-risc.c b/drivers/media/video/bt8xx/bttv-risc.c
index 16323a5d68ac..afcfe71e3792 100644
--- a/drivers/media/video/bt8xx/bttv-risc.c
+++ b/drivers/media/video/bt8xx/bttv-risc.c
@@ -233,7 +233,7 @@ bttv_risc_overlay(struct bttv *btv, struct btcx_riscmem *risc,
                   const struct bttv_format *fmt, struct bttv_overlay *ov,
                   int skip_even, int skip_odd)
 {
-        int instructions,rc,line,maxy,start,end,skip,nskips;
+        int dwords,rc,line,maxy,start,end,skip,nskips;
         struct btcx_skiplist *skips;
         u32 *rp,ri,ra;
         u32 addr;
@@ -242,12 +242,12 @@ bttv_risc_overlay(struct bttv *btv, struct btcx_riscmem *risc,
         if (NULL == (skips = kmalloc(sizeof(*skips) * ov->nclips,GFP_KERNEL)))
                 return -ENOMEM;
 
-        /* estimate risc mem: worst case is (clip+1) * lines instructions
+        /* estimate risc mem: worst case is (1.5*clip+1) * lines instructions
            + sync + jump (all 2 dwords) */
-        instructions  = (ov->nclips + 1) *
-                ((skip_even || skip_odd) ? ov->w.height>>1 :  ov->w.height);
-        instructions += 2;
-        if ((rc = btcx_riscmem_alloc(btv->c.pci,risc,instructions*8)) < 0) {
+        dwords  = (3 * ov->nclips + 2) *
+                ((skip_even || skip_odd) ? (ov->w.height+1)>>1 :  ov->w.height);
+        dwords += 4;
+        if ((rc = btcx_riscmem_alloc(btv->c.pci,risc,dwords*4)) < 0) {
                 kfree(skips);
                 return rc;
         }
@@ -276,8 +276,6 @@ bttv_risc_overlay(struct bttv *btv, struct btcx_riscmem *risc,
                 if (line > maxy)
                         btcx_calc_skips(line, ov->w.width, &maxy,
                                         skips, &nskips, ov->clips, ov->nclips);
-                else
-                        nskips = 0;
 
                 /* write out risc code */
                 for (start = 0, skip = 0; start < ov->w.width; start = end) {