diff options
| author | Mauro Carvalho Chehab <mchehab@redhat.com> | 2013-04-07 20:51:32 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2013-04-08 07:10:33 -0300 |
| commit | 41c6e9dd0915741051e813cafa14f2e7f88b71d9 (patch) | |
| tree | 2165797aeaf017b5624e47d5e5fc551387280acf /drivers/media/dvb-frontends | |
| parent | 4f62a20dfbdf46825dea707a033f941874e34930 (diff) | |
[media] mb86a20s: fix audio sub-channel check
As reported by Dan Carpenter <dan.carpenter@oracle.com>
FYI, there are new smatch warnings show up in:
tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next master
head: da17d7bda957ae4697b6abc0793f74fb9b50b58f
commit: 04fa725e7b1c22c583dd71a8cd85b8d997edfce3 [media] mb86a20s: Implement set_frontend cache logic
New smatch warnings:
drivers/media/dvb-frontends/mb86a20s.c:1897 mb86a20s_set_frontend() error: buffer overflow 'mb86a20s_subchannel' 8 <= 8
04fa725e Mauro Carvalho Chehab 2013-03-04 1894 if (c->isdbt_sb_subchannel > ARRAY_SIZE(mb86a20s_subchannel))
04fa725e Mauro Carvalho Chehab 2013-03-04 1895 c->isdbt_sb_subchannel = 0;
04fa725e Mauro Carvalho Chehab 2013-03-04 1896
04fa725e Mauro Carvalho Chehab 2013-03-04 @1897 state->subchannel = mb86a20s_subchannel[c->isdbt_sb_subchannel];
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/dvb-frontends')
| -rw-r--r-- | drivers/media/dvb-frontends/mb86a20s.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/media/dvb-frontends/mb86a20s.c b/drivers/media/dvb-frontends/mb86a20s.c index 80a8ee090c8..70158aae188 100644 --- a/drivers/media/dvb-frontends/mb86a20s.c +++ b/drivers/media/dvb-frontends/mb86a20s.c @@ -1915,7 +1915,7 @@ static int mb86a20s_set_frontend(struct dvb_frontend *fe) if (!c->isdbt_sb_mode) { state->subchannel = 0; } else { - if (c->isdbt_sb_subchannel > ARRAY_SIZE(mb86a20s_subchannel)) + if (c->isdbt_sb_subchannel >= ARRAY_SIZE(mb86a20s_subchannel)) c->isdbt_sb_subchannel = 0; state->subchannel = mb86a20s_subchannel[c->isdbt_sb_subchannel]; |