Skip to content

Commit

Permalink
[media] mb86a20s: fix audio sub-channel check
Browse files Browse the repository at this point in the history
As reported by Dan Carpenter <dan.carpenter@oracle.com>
FYI, there are new smatch warnings show up in:
	tree:   git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next master
	head:   da17d7bda957ae4697b6abc0793f74fb9b50b58f
	commit: 04fa725 [media] mb86a20s: Implement set_frontend cache logic
	New smatch warnings:
	drivers/media/dvb-frontends/mb86a20s.c:1897 mb86a20s_set_frontend() error: buffer overflow 'mb86a20s_subchannel' 8 <= 8
	04fa725 Mauro Carvalho Chehab 2013-03-04  1894  		if (c->isdbt_sb_subchannel > ARRAY_SIZE(mb86a20s_subchannel))
	04fa725 Mauro Carvalho Chehab 2013-03-04  1895  			c->isdbt_sb_subchannel = 0;
	04fa725 Mauro Carvalho Chehab 2013-03-04  1896
	04fa725 Mauro Carvalho Chehab 2013-03-04 @1897  		state->subchannel = mb86a20s_subchannel[c->isdbt_sb_subchannel];

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
  • Loading branch information
Mauro Carvalho Chehab committed Apr 8, 2013
1 parent 4f62a20 commit 41c6e9d
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/media/dvb-frontends/mb86a20s.c
Original file line number Diff line number Diff line change
Expand Up @@ -1915,7 +1915,7 @@ static int mb86a20s_set_frontend(struct dvb_frontend *fe)
if (!c->isdbt_sb_mode) {
state->subchannel = 0;
} else {
if (c->isdbt_sb_subchannel > ARRAY_SIZE(mb86a20s_subchannel))
if (c->isdbt_sb_subchannel >= ARRAY_SIZE(mb86a20s_subchannel))
c->isdbt_sb_subchannel = 0;

state->subchannel = mb86a20s_subchannel[c->isdbt_sb_subchannel];
Expand Down

0 comments on commit 41c6e9d

Please sign in to comment.