Skip to content

Commit

Permalink
V4L/DVB (12337): ivtv: Read buffer overflow
Browse files Browse the repository at this point in the history
This mistakenly tests against sizeof(freqs) instead of the array size. Due to
the mask the only illegal value possible was 3.

Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Andy Walls <awalls@radix.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
  • Loading branch information
Roel Kluin authored and Mauro Carvalho Chehab committed Aug 13, 2009
1 parent 5b76618 commit ed18d0c
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion drivers/media/video/ivtv/ivtv-controls.c
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include <linux/kernel.h>

#include "ivtv-driver.h"
#include "ivtv-cards.h"
Expand Down Expand Up @@ -281,7 +282,7 @@ int ivtv_s_ext_ctrls(struct file *file, void *fh, struct v4l2_ext_controls *c)
idx = p.audio_properties & 0x03;
/* The audio clock of the digitizer must match the codec sample
rate otherwise you get some very strange effects. */
if (idx < sizeof(freqs))
if (idx < ARRAY_SIZE(freqs))
ivtv_call_all(itv, audio, s_clock_freq, freqs[idx]);
return err;
}
Expand Down

0 comments on commit ed18d0c

Please sign in to comment.