Commit 3cc26912 authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab

[media] ttusb_dec: avoid the risk of go past buffer

Fixes this smatch warning:
	drivers/media/usb/ttusb-dec/ttusb_dec.c:243 ttusb_dec_handle_irq() error: buffer overflow 'rc_keys' 26 <= 126

As the RC keys should be enabled previously, via:
	set_bit(rc_keys[i], input_dev->keybit);

It wouldn't go past the buffer in practice. Yet, as bad
things may happen when going past buffer, it doesn't hurt adding
a check here.

While here, fix CodingStyle issues on the routine.
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent e837d85c
...@@ -206,7 +206,7 @@ static void ttusb_dec_set_model(struct ttusb_dec *dec, ...@@ -206,7 +206,7 @@ static void ttusb_dec_set_model(struct ttusb_dec *dec,
static void ttusb_dec_handle_irq( struct urb *urb) static void ttusb_dec_handle_irq( struct urb *urb)
{ {
struct ttusb_dec * dec = urb->context; struct ttusb_dec *dec = urb->context;
char *buffer = dec->irq_buffer; char *buffer = dec->irq_buffer;
int retval; int retval;
...@@ -227,25 +227,31 @@ static void ttusb_dec_handle_irq( struct urb *urb) ...@@ -227,25 +227,31 @@ static void ttusb_dec_handle_irq( struct urb *urb)
goto exit; goto exit;
} }
if( (buffer[0] == 0x1) && (buffer[2] == 0x15) ) { if ((buffer[0] == 0x1) && (buffer[2] == 0x15)) {
/* IR - Event */ /*
/* this is an fact a bit too simple implementation; * IR - Event
*
* this is an fact a bit too simple implementation;
* the box also reports a keyrepeat signal * the box also reports a keyrepeat signal
* (with buffer[3] == 0x40) in an intervall of ~100ms. * (with buffer[3] == 0x40) in an intervall of ~100ms.
* But to handle this correctly we had to imlemenent some * But to handle this correctly we had to imlemenent some
* kind of timer which signals a 'key up' event if no * kind of timer which signals a 'key up' event if no
* keyrepeat signal is received for lets say 200ms. * keyrepeat signal is received for lets say 200ms.
* this should/could be added later ... * this should/could be added later ...
* for now lets report each signal as a key down and up*/ * for now lets report each signal as a key down and up
*/
if (buffer[4] - 1 < ARRAY_SIZE(rc_keys)) {
dprintk("%s:rc signal:%d\n", __func__, buffer[4]); dprintk("%s:rc signal:%d\n", __func__, buffer[4]);
input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 1); input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 1);
input_sync(dec->rc_input_dev); input_sync(dec->rc_input_dev);
input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 0); input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 0);
input_sync(dec->rc_input_dev); input_sync(dec->rc_input_dev);
} }
}
exit: retval = usb_submit_urb(urb, GFP_ATOMIC); exit:
if(retval) retval = usb_submit_urb(urb, GFP_ATOMIC);
if (retval)
printk("%s - usb_commit_urb failed with result: %d\n", printk("%s - usb_commit_urb failed with result: %d\n",
__func__, retval); __func__, retval);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment