diff options
author | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2014-10-28 09:07:03 -0400 |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2015-03-03 08:34:12 -0500 |
commit | a132fef816606ebe9d20895b1535582bfede12a4 (patch) | |
tree | 3a15c4eaff7b0031a9f8d48e39cfd1ff428c25ea /drivers/media | |
parent | 15c546e1c896058ebffc437e609000b3bf394451 (diff) |
[media] lgdt3306a: don't go past the buffer
As warned by smatch:
drivers/media/dvb-frontends/lgdt3306a.c:1354 log10_x1000() error: buffer overflow 'valx_x10' 14 <= 14
drivers/media/dvb-frontends/lgdt3306a.c:1355 log10_x1000() error: buffer overflow 'log10x_x1000' 14 <= 14
There's a potential of returning a value out of the buffer. Fix it.
While here, remove the ugly braced block.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Diffstat (limited to 'drivers/media')
-rw-r--r-- | drivers/media/dvb-frontends/lgdt3306a.c | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c index c8af071ce40b..92affe124a8d 100644 --- a/drivers/media/dvb-frontends/lgdt3306a.c +++ b/drivers/media/dvb-frontends/lgdt3306a.c | |||
@@ -1319,6 +1319,7 @@ static u32 log10_x1000(u32 x) | |||
1319 | static u32 valx_x10[] = { 10, 11, 13, 15, 17, 20, 25, 33, 41, 50, 59, 73, 87, 100 }; | 1319 | static u32 valx_x10[] = { 10, 11, 13, 15, 17, 20, 25, 33, 41, 50, 59, 73, 87, 100 }; |
1320 | static u32 log10x_x1000[] = { 0, 41, 114, 176, 230, 301, 398, 518, 613, 699, 771, 863, 939, 1000 }; | 1320 | static u32 log10x_x1000[] = { 0, 41, 114, 176, 230, 301, 398, 518, 613, 699, 771, 863, 939, 1000 }; |
1321 | static u32 nelems = sizeof(valx_x10)/sizeof(valx_x10[0]); | 1321 | static u32 nelems = sizeof(valx_x10)/sizeof(valx_x10[0]); |
1322 | u32 diff_val, step_val, step_log10; | ||
1322 | u32 log_val = 0; | 1323 | u32 log_val = 0; |
1323 | u32 i; | 1324 | u32 i; |
1324 | 1325 | ||
@@ -1348,15 +1349,16 @@ static u32 log10_x1000(u32 x) | |||
1348 | if (valx_x10[i] >= x) | 1349 | if (valx_x10[i] >= x) |
1349 | break; | 1350 | break; |
1350 | } | 1351 | } |
1352 | if (i == nelems) | ||
1353 | return log_val + log10x_x1000[i - 1]; | ||
1351 | 1354 | ||
1352 | { | 1355 | diff_val = x - valx_x10[i-1]; |
1353 | u32 diff_val = x - valx_x10[i-1]; | 1356 | step_val = valx_x10[i] - valx_x10[i - 1]; |
1354 | u32 step_val = valx_x10[i] - valx_x10[i-1]; | 1357 | step_log10 = log10x_x1000[i] - log10x_x1000[i - 1]; |
1355 | u32 step_log10 = log10x_x1000[i] - log10x_x1000[i-1]; | 1358 | |
1356 | /* do a linear interpolation to get in-between values */ | 1359 | /* do a linear interpolation to get in-between values */ |
1357 | return log_val + log10x_x1000[i-1] + | 1360 | return log_val + log10x_x1000[i - 1] + |
1358 | ((diff_val*step_log10) / step_val); | 1361 | ((diff_val*step_log10) / step_val); |
1359 | } | ||
1360 | } | 1362 | } |
1361 | 1363 | ||
1362 | static u32 lgdt3306a_calculate_snr_x100(struct lgdt3306a_state *state) | 1364 | static u32 lgdt3306a_calculate_snr_x100(struct lgdt3306a_state *state) |