Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0123f29c authored by Ole Ernst's avatar Ole Ernst Committed by Mauro Carvalho Chehab
Browse files

[media] dvb_frontend: Fix possible read out of bounds 



Check if index is within bounds _before_ accessing the value.

Signed-off-by: default avatarOle Ernst <olebowle@gmx.com>
Signed-off-by: default avatarMauro Carvalho Chehab <m.chehab@samsung.com>
parent 2f9dff3f

drivers/media/dvb-core/dvb_frontend.c

+4 −4
Original line number Original line Diff line number Diff line
@@ -1279,7 +1279,7 @@ static int dtv_property_process_get(struct dvb_frontend *fe, 
	switch(tvp->cmd) {

	switch(tvp->cmd) {

	case DTV_ENUM_DELSYS:

	case DTV_ENUM_DELSYS:

		ncaps = 0;

		ncaps = 0;

		while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) {

		while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {

			tvp->u.buffer.data[ncaps] = fe->ops.delsys[ncaps];

			tvp->u.buffer.data[ncaps] = fe->ops.delsys[ncaps];

			ncaps++;

			ncaps++;

		}

		}
@@ -1596,7 +1596,7 @@ static int dvbv5_set_delivery_system(struct dvb_frontend *fe, 
	 * supported

	 * supported

	 */

	 */

	ncaps = 0;

	ncaps = 0;

	while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) {

	while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {

		if (fe->ops.delsys[ncaps] == desired_system) {

		if (fe->ops.delsys[ncaps] == desired_system) {

			c->delivery_system = desired_system;

			c->delivery_system = desired_system;

			dev_dbg(fe->dvb->device,

			dev_dbg(fe->dvb->device,
@@ -1628,7 +1628,7 @@ static int dvbv5_set_delivery_system(struct dvb_frontend *fe, 
	* of the desired system

	* of the desired system

	*/

	*/

	ncaps = 0;

	ncaps = 0;

	while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) {

	while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {

		if (dvbv3_type(fe->ops.delsys[ncaps]) == type)

		if (dvbv3_type(fe->ops.delsys[ncaps]) == type)

			delsys = fe->ops.delsys[ncaps];

			delsys = fe->ops.delsys[ncaps];

		ncaps++;

		ncaps++;
@@ -1703,7 +1703,7 @@ static int dvbv3_set_delivery_system(struct dvb_frontend *fe) 
	 * DVBv3 standard

	 * DVBv3 standard

	 */

	 */

	ncaps = 0;

	ncaps = 0;

	while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) {

	while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {

		if (dvbv3_type(fe->ops.delsys[ncaps]) != DVBV3_UNKNOWN) {

		if (dvbv3_type(fe->ops.delsys[ncaps]) != DVBV3_UNKNOWN) {

			delsys = fe->ops.delsys[ncaps];

			delsys = fe->ops.delsys[ncaps];

			break;

			break;