Commit bca3ba79 authored May 26, 2011 by Dan Carpenter Committed by Mauro Carvalho Chehab Jul 27, 2011

[media] DVB: dvb_frontend: off by one in dtv_property_dump()



If the tvp->cmd == DTV_MAX_COMMAND then we read past the end of the
array.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

parent 0cf8af57

drivers/media/dvb/dvb-core/dvb_frontend.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -982,7 +982,7 @@ static void dtv_property_dump(struct dtv_property *tvp)
		{
		int i;

		if (tvp->cmd <= 0 \|\| tvp->cmd > DTV_MAX_COMMAND) {
		if (tvp->cmd <= 0 \|\| tvp->cmd >= DTV_MAX_COMMAND) {
		printk(KERN_WARNING "%s: tvp.cmd = 0x%08x undefined\n",
		__func__, tvp->cmd);
		return;