Commit ffe30010 authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab

[media] stv090x: add an extra protetion against buffer overflow

As pointed by smatch:
	drivers/media/dvb-frontends/stv090x.c:2787 stv090x_optimize_carloop() error: buffer overflow 'car_loop_apsk_low' 11 <= 13
	drivers/media/dvb-frontends/stv090x.c:2789 stv090x_optimize_carloop() error: buffer overflow 'car_loop_apsk_low' 11 <= 13
	drivers/media/dvb-frontends/stv090x.c:2791 stv090x_optimize_carloop() error: buffer overflow 'car_loop_apsk_low' 11 <= 13
	drivers/media/dvb-frontends/stv090x.c:2793 stv090x_optimize_carloop() error: buffer overflow 'car_loop_apsk_low' 11 <= 13
	drivers/media/dvb-frontends/stv090x.c:2795 stv090x_optimize_carloop() error: buffer overflow 'car_loop_apsk_low' 11 <= 13

The situation of a buffer overflow won't happen, in practice,
with the current values of car_loop table. Yet, the entire logic
that checks for those registration values is too complex. So,
better to add an explicit check, just in case someone changes
the car_loop tables causing a buffer overflow by mistake.

This also helps to remove several smatch warnings, with is good.
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
parent b769ef69
...@@ -2783,6 +2783,12 @@ static u8 stv090x_optimize_carloop(struct stv090x_state *state, enum stv090x_mod ...@@ -2783,6 +2783,12 @@ static u8 stv090x_optimize_carloop(struct stv090x_state *state, enum stv090x_mod
aclc = car_loop[i].crl_pilots_off_30; aclc = car_loop[i].crl_pilots_off_30;
} }
} else { /* 16APSK and 32APSK */ } else { /* 16APSK and 32APSK */
/*
* This should never happen in practice, except if
* something is really wrong at the car_loop table.
*/
if (i >= 11)
i = 10;
if (state->srate <= 3000000) if (state->srate <= 3000000)
aclc = car_loop_apsk_low[i].crl_pilots_on_2; aclc = car_loop_apsk_low[i].crl_pilots_on_2;
else if (state->srate <= 7000000) else if (state->srate <= 7000000)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment