Commit bca3ba79 authored by Dan Carpenter's avatar Dan Carpenter Committed by Mauro Carvalho Chehab

[media] DVB: dvb_frontend: off by one in dtv_property_dump()

If the tvp->cmd == DTV_MAX_COMMAND then we read past the end of the
array.
Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 0cf8af57
...@@ -982,7 +982,7 @@ static void dtv_property_dump(struct dtv_property *tvp) ...@@ -982,7 +982,7 @@ static void dtv_property_dump(struct dtv_property *tvp)
{ {
int i; int i;
if (tvp->cmd <= 0 || tvp->cmd > DTV_MAX_COMMAND) { if (tvp->cmd <= 0 || tvp->cmd >= DTV_MAX_COMMAND) {
printk(KERN_WARNING "%s: tvp.cmd = 0x%08x undefined\n", printk(KERN_WARNING "%s: tvp.cmd = 0x%08x undefined\n",
__func__, tvp->cmd); __func__, tvp->cmd);
return; return;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment