diff options
| author | Daniel Scheller <d.scheller@gmx.net> | 2017-07-09 15:42:45 -0400 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@s-opensource.com> | 2017-08-20 07:27:35 -0400 |
| commit | b9a92f62c555a37e5676f695e94616a261f9403e (patch) | |
| tree | 3f6132ec8090423dedd7952bfc641692b54329bd | |
| parent | bb4cec96e5d7f0ff7f397f4518399be77a2f12db (diff) | |
media: ddbridge: fix buffer overflow in max_set_input_unlocked()
Picked up code parts introduced one smatch error:
drivers/media/pci/ddbridge/ddbridge-maxs8.c:163 max_set_input_unlocked() error: buffer overflow 'dev->link[port->lnr].lnb.voltage' 4 <= 255
Fix this by clamping the .lnb.voltage array access to 0-3 by "& 3"'ing
dvb->input.
Cc: Ralph Metzler <rjkm@metzlerbros.de>
Signed-off-by: Daniel Scheller <d.scheller@gmx.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
| -rw-r--r-- | drivers/media/pci/ddbridge/ddbridge-maxs8.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/media/pci/ddbridge/ddbridge-maxs8.c b/drivers/media/pci/ddbridge/ddbridge-maxs8.c index a9dc5f9754da..10716ee8cf59 100644 --- a/drivers/media/pci/ddbridge/ddbridge-maxs8.c +++ b/drivers/media/pci/ddbridge/ddbridge-maxs8.c @@ -187,11 +187,12 @@ static int max_set_input_unlocked(struct dvb_frontend *fe, int in) return -EINVAL; if (dvb->input != in) { u32 bit = (1ULL << input->nr); - u32 obit = dev->link[port->lnr].lnb.voltage[dvb->input] & bit; + u32 obit = + dev->link[port->lnr].lnb.voltage[dvb->input & 3] & bit; - dev->link[port->lnr].lnb.voltage[dvb->input] &= ~bit; + dev->link[port->lnr].lnb.voltage[dvb->input & 3] &= ~bit; dvb->input = in; - dev->link[port->lnr].lnb.voltage[dvb->input] |= obit; + dev->link[port->lnr].lnb.voltage[dvb->input & 3] |= obit; } res = dvb->set_input(fe, in); return res; |