From: Mauro Carvalho Chehab Date: Wed, 5 Nov 2014 11:42:22 +0000 (-0200) Subject: [media] cx22700: Fix potential buffer overflow X-Git-Tag: v3.19-rc1~126^2~196 X-Git-Url: https://openfabrics.org/gitweb/?a=commitdiff_plain;h=667c952e7191ffb0a2703c8e173b0d5f0231a764;p=~emulex%2Finfiniband.git [media] cx22700: Fix potential buffer overflow As new FEC types were added, we need a check to avoid overflows: drivers/media/dvb-frontends/cx22700.c:172 cx22700_set_tps() error: buffer overflow 'fec_tab' 6 <= 6 drivers/media/dvb-frontends/cx22700.c:173 cx22700_set_tps() error: buffer overflow 'fec_tab' 6 <= 6 Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/dvb-frontends/cx22700.c b/drivers/media/dvb-frontends/cx22700.c index 3d399d9a634..86563260d0f 100644 --- a/drivers/media/dvb-frontends/cx22700.c +++ b/drivers/media/dvb-frontends/cx22700.c @@ -169,6 +169,9 @@ static int cx22700_set_tps(struct cx22700_state *state, cx22700_writereg (state, 0x04, val); + if (p->code_rate_HP - FEC_1_2 >= sizeof(fec_tab) || + p->code_rate_LP - FEC_1_2 >= sizeof(fec_tab)) + return -EINVAL; val = fec_tab[p->code_rate_HP - FEC_1_2] << 3; val |= fec_tab[p->code_rate_LP - FEC_1_2];