samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[media] dvb_frontend: Fix possible read out of bounds

Browse Source 
Check if index is within bounds _before_ accessing the value.

Signed-off-by: Ole Ernst <olebowle@gmx.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
This commit is contained in:
Ole Ernst
2014-03-05 14:08:15 -03:00
committed by Mauro Carvalho Chehab
parent 2f9dff3f39
commit 0123f29caf
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/media/dvb-core/dvb_frontend.c
View File

@@ -1279,7 +1279,7 @@ static int dtv_property_process_get(struct dvb_frontend *fe,
switch(tvp->cmd) { switch(tvp->cmd) {
case DTV_ENUM_DELSYS: case DTV_ENUM_DELSYS:
ncaps = 0; ncaps = 0;
while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) { while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {
tvp->u.buffer.data[ncaps] = fe->ops.delsys[ncaps]; tvp->u.buffer.data[ncaps] = fe->ops.delsys[ncaps];
ncaps++; ncaps++;
} }
@@ -1596,7 +1596,7 @@ static int dvbv5_set_delivery_system(struct dvb_frontend *fe,
* supported * supported
*/ */
ncaps = 0; ncaps = 0;
while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) { while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {
if (fe->ops.delsys[ncaps] == desired_system) { if (fe->ops.delsys[ncaps] == desired_system) {
c->delivery_system = desired_system; c->delivery_system = desired_system;
dev_dbg(fe->dvb->device, dev_dbg(fe->dvb->device,
@@ -1628,7 +1628,7 @@ static int dvbv5_set_delivery_system(struct dvb_frontend *fe,
* of the desired system * of the desired system
*/ */
ncaps = 0; ncaps = 0;
while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) { while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {
if (dvbv3_type(fe->ops.delsys[ncaps]) == type) if (dvbv3_type(fe->ops.delsys[ncaps]) == type)
delsys = fe->ops.delsys[ncaps]; delsys = fe->ops.delsys[ncaps];
ncaps++; ncaps++;
@@ -1703,7 +1703,7 @@ static int dvbv3_set_delivery_system(struct dvb_frontend *fe)
* DVBv3 standard * DVBv3 standard
*/ */
ncaps = 0; ncaps = 0;
while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) { while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {
if (dvbv3_type(fe->ops.delsys[ncaps]) != DVBV3_UNKNOWN) { if (dvbv3_type(fe->ops.delsys[ncaps]) != DVBV3_UNKNOWN) {
delsys = fe->ops.delsys[ncaps]; delsys = fe->ops.delsys[ncaps];
break; break;