Commit cb26a24e authored Jan 07, 2011 by Dan Carpenter Committed by Mauro Carvalho Chehab Jan 19, 2011

[media] [v3,media] av7110: check for negative array offset



info->num comes from the user.  It's type int.  If the user passes
in a negative value that would cause memory corruption.

Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

parent 76f1ef42

drivers/media/dvb/ttpci/av7110_ca.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -277,7 +277,7 @@ static int dvb_ca_ioctl(struct file file, unsigned int cmd, void parg)
		{
		ca_slot_info_t info=(ca_slot_info_t )parg;

		if (info->num > 1)
		if (info->num < 0 \|\| info->num > 1)
		return -EINVAL;
		av7110->ci_slot[info->num].num = info->num;
		av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?