From: Hans Verkuil <hans.verkuil@cisco.com>
Date: Tue, 15 Oct 2013 15:24:45 +0000 (-0300)
Subject: [media] si4713: si4713_set_rds_radio_text overwrites terminating \0
X-Git-Tag: v3.14-rc1~20^2~268
X-Git-Url: https://openfabrics.org/gitweb/?a=commitdiff_plain;h=8aab72bb0797321c6f6867f240da1e8c28bf040c;p=~emulex%2Finfiniband.git

[media] si4713: si4713_set_rds_radio_text overwrites terminating \0

si4713_set_rds_radio_text will overwrite the terminating zero at the
end of the rds radio text string in order to send out a carriage return
as per the RDS spec.
Use a separate char buffer for the CR instead of corrupting the control
string.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Tested-by: Eduardo Valentin <edubezval@gmail.com>
Acked-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
---

diff --git a/drivers/media/radio/si4713/si4713.c b/drivers/media/radio/si4713/si4713.c
index 097d4e09b49..17e0106a771 100644
--- a/drivers/media/radio/si4713/si4713.c
+++ b/drivers/media/radio/si4713/si4713.c
@@ -831,8 +831,9 @@ static int si4713_set_rds_ps_name(struct si4713_device *sdev, char *ps_name)
 	return rval;
 }
 
-static int si4713_set_rds_radio_text(struct si4713_device *sdev, char *rt)
+static int si4713_set_rds_radio_text(struct si4713_device *sdev, const char *rt)
 {
+	static const char cr[RDS_RADIOTEXT_BLK_SIZE] = { RDS_CARRIAGE_RETURN, 0 };
 	int rval = 0, i;
 	u16 t_index = 0;
 	u8 b_index = 0, cr_inserted = 0;
@@ -856,7 +857,7 @@ static int si4713_set_rds_radio_text(struct si4713_device *sdev, char *rt)
 			for (i = 0; i < RDS_RADIOTEXT_BLK_SIZE; i++) {
 				if (!rt[t_index + i] ||
 				    rt[t_index + i] == RDS_CARRIAGE_RETURN) {
-					rt[t_index + i] = RDS_CARRIAGE_RETURN;
+					rt = cr;
 					cr_inserted = 1;
 					break;
 				}