[media] qt1010: avoid going past array
authorMauro Carvalho Chehab <mchehab@osg.samsung.com>
Wed, 29 Apr 2015 12:33:02 +0000 (09:33 -0300)
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>
Thu, 30 Apr 2015 17:57:35 +0000 (14:57 -0300)
As reported by smatch:
drivers/media/tuners/qt1010.c:357 qt1010_init() error: buffer overflow 'i2c_data' 34 <= 34

This should not happen with the current code, as the i2c_data array
doesn't end with a QT1010_M1, but it doesn't hurt add a BUG_ON
to notify if one modifies it and breaks.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/tuners/qt1010.c

index 74b6b17cdbafce61509058c752e9cf81442a9339..ae8cbece6d2bcbea783b2722ba1d2b5a805ebeec 100644 (file)
@@ -354,13 +354,17 @@ static int qt1010_init(struct dvb_frontend *fe)
                                valptr = &priv->reg1f_init_val;
                        else
                                valptr = &tmpval;
+
+                       BUG_ON(i >= ARRAY_SIZE(i2c_data) - 1);
+
                        err = qt1010_init_meas1(priv, i2c_data[i+1].reg,
                                                i2c_data[i].reg,
                                                i2c_data[i].val, valptr);
                        i++;
                        break;
                }
-               if (err) return err;
+               if (err)
+                       return err;
        }
 
        for (i = 0x31; i < 0x3a; i++) /* 0x31 - 0x39 */
This page took 0.025852 seconds and 5 git commands to generate.