V4L/DVB (6644): xc2028: use correct offset into scode firmware

When validating and loading SCODE firmware we need to take into account the
two-byte size header before each entry.

Signed-off-by: Chris Pascoe <c.pascoe@itee.uq.edu.au>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 10 insertions, 2 deletions

diff --git a/drivers/media/video/tuner-xc2028.c b/drivers/media/video/tuner-xc2028.c
index 3edf5be47197..fbaab68fd05c 100644
--- a/drivers/media/video/tuner-xc2028.c
+++ b/drivers/media/video/tuner-xc2028.c
@@ -565,9 +565,17 @@ static int load_scode(struct dvb_frontend *fe, unsigned int type,
 
         p = priv->firm[pos].ptr;
 
-        if ((priv->firm[pos].size != 12 * 16) || (scode >= 16))
+        /* 16 SCODE entries per file; each SCODE entry is 12 bytes and
+         * has a 2-byte size header in the firmware format. */
+        if (priv->firm[pos].size != 14 * 16 || scode >= 16 ||
+            le16_to_cpu(*(__u16 *)(p + 14 * scode)) != 12)
                 return -EINVAL;
 
+        tuner_info("Loading SCODE for type=");
+        dump_firm_type(priv->firm[pos].type);
+        printk("(%x), id %016llx.\n", priv->firm[pos].type,
+               (unsigned long long)*id);
+
         if (priv->firm_version < 0x0202)
                 rc = send_seq(priv, {0x20, 0x00, 0x00, 0x00});
         else
@@ -575,7 +583,7 @@ static int load_scode(struct dvb_frontend *fe, unsigned int type,
         if (rc < 0)
                 return -EIO;
 
-        rc = i2c_send(priv, p + 12 * scode, 12);
+        rc = i2c_send(priv, p + 14 * scode + 2, 12);
         if (rc < 0)
                 return -EIO;