Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3cc26912 authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab
Browse files

[media] ttusb_dec: avoid the risk of go past buffer 



Fixes this smatch warning:
	drivers/media/usb/ttusb-dec/ttusb_dec.c:243 ttusb_dec_handle_irq() error: buffer overflow 'rc_keys' 26 <= 126

As the RC keys should be enabled previously, via:
	set_bit(rc_keys[i], input_dev->keybit);

It wouldn't go past the buffer in practice. Yet, as bad
things may happen when going past buffer, it doesn't hurt adding
a check here.

While here, fix CodingStyle issues on the routine.

Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
parent e837d85c

drivers/media/usb/ttusb-dec/ttusb_dec.c

+18 −12
Original line number Diff line number Diff line
@@ -228,23 +228,29 @@ static void ttusb_dec_handle_irq( struct urb *urb) 
	}



	if ((buffer[0] == 0x1) && (buffer[2] == 0x15))  {

		/* IR - Event */

		/* this is an fact a bit too simple implementation;

		/*

		 * IR - Event

		 *

		 * this is an fact a bit too simple implementation;

		 * the box also reports a keyrepeat signal

		 * (with buffer[3] == 0x40) in an intervall of ~100ms.

		 * But to handle this correctly we had to imlemenent some

		 * kind of timer which signals a 'key up' event if no

		 * keyrepeat signal is received for lets say 200ms.

		 * this should/could be added later ...

		 * for now lets report each signal as a key down and up*/

		 * for now lets report each signal as a key down and up

		 */

		if (buffer[4] - 1 < ARRAY_SIZE(rc_keys)) {

			dprintk("%s:rc signal:%d\n", __func__, buffer[4]);

			input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 1);

			input_sync(dec->rc_input_dev);

			input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 0);

			input_sync(dec->rc_input_dev);

		}

	}



exit:	retval = usb_submit_urb(urb, GFP_ATOMIC);

exit:

	retval = usb_submit_urb(urb, GFP_ATOMIC);

	if (retval)

		printk("%s - usb_commit_urb failed with result: %d\n",

			__func__, retval);