Skip to content

Commit

Permalink
V4L/DVB (12338): cx18: Read buffer overflow
Browse files Browse the repository at this point in the history
This mistakenly tested against sizeof(freqs) instead of the array size. Due to
the mask the only illegal value possible was 3.

Reported-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Andy Walls <awalls@radix.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
  • Loading branch information
Andy Walls authored and Mauro Carvalho Chehab committed Aug 13, 2009
1 parent ed18d0c commit 225aeb1
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion drivers/media/video/cx18/cx18-controls.c
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
* 02111-1307 USA
*/
#include <linux/kernel.h>

#include "cx18-driver.h"
#include "cx18-cards.h"
Expand Down Expand Up @@ -317,7 +318,7 @@ int cx18_s_ext_ctrls(struct file *file, void *fh, struct v4l2_ext_controls *c)
idx = p.audio_properties & 0x03;
/* The audio clock of the digitizer must match the codec sample
rate otherwise you get some very strange effects. */
if (idx < sizeof(freqs))
if (idx < ARRAY_SIZE(freqs))
cx18_call_all(cx, audio, s_clock_freq, freqs[idx]);
return err;
}
Expand Down

0 comments on commit 225aeb1

Please sign in to comment.