diff options
| author | Daniel Scheller | 2017-07-09 21:42:45 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab | 2017-08-20 13:27:35 +0200 |
| commit | b9a92f62c555a37e5676f695e94616a261f9403e (patch) | |
| tree | 3f6132ec8090423dedd7952bfc641692b54329bd /drivers/media/pci/ddbridge | |
| parent | media: ddbridge: support MaxLinear MXL5xx based cards (MaxS4/8) (diff) | |
| download | kernel-qcow2-linux-b9a92f62c555a37e5676f695e94616a261f9403e.tar.gz kernel-qcow2-linux-b9a92f62c555a37e5676f695e94616a261f9403e.tar.xz kernel-qcow2-linux-b9a92f62c555a37e5676f695e94616a261f9403e.zip | |
media: ddbridge: fix buffer overflow in max_set_input_unlocked()
Picked up code parts introduced one smatch error:
drivers/media/pci/ddbridge/ddbridge-maxs8.c:163 max_set_input_unlocked() error: buffer overflow 'dev->link[port->lnr].lnb.voltage' 4 <= 255
Fix this by clamping the .lnb.voltage array access to 0-3 by "& 3"'ing
dvb->input.
Cc: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: Daniel Scheller <d.scheller@gmx.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media/pci/ddbridge')
| -rw-r--r-- | drivers/media/pci/ddbridge/ddbridge-maxs8.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/media/pci/ddbridge/ddbridge-maxs8.c b/drivers/media/pci/ddbridge/ddbridge-maxs8.c index a9dc5f9754da..10716ee8cf59 100644 --- a/drivers/media/pci/ddbridge/ddbridge-maxs8.c +++ b/drivers/media/pci/ddbridge/ddbridge-maxs8.c @@ -187,11 +187,12 @@ static int max_set_input_unlocked(struct dvb_frontend *fe, int in) return -EINVAL; if (dvb->input != in) { u32 bit = (1ULL << input->nr); - u32 obit = dev->link[port->lnr].lnb.voltage[dvb->input] & bit; + u32 obit = + dev->link[port->lnr].lnb.voltage[dvb->input & 3] & bit; - dev->link[port->lnr].lnb.voltage[dvb->input] &= ~bit; + dev->link[port->lnr].lnb.voltage[dvb->input & 3] &= ~bit; dvb->input = in; - dev->link[port->lnr].lnb.voltage[dvb->input] |= obit; + dev->link[port->lnr].lnb.voltage[dvb->input & 3] |= obit; } res = dvb->set_input(fe, in); return res; |