Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e34d375a authored by Jiri Slaby's avatar Jiri Slaby Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (13968): cx18, fix potential null dereference 



Stanse found a potential null dereference in cx18_dvb_start_feed
and cx18_dvb_stop_feed. There is a check for stream being NULL,
but it is dereferenced earlier. Move the dereference after the
check.

Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
Reviewed-by: default avatarAndy Walls <awalls@radix.net>
Acked-by: default avatarAndy Walls <awalls@radix.net>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 8231152f

drivers/media/video/cx18/cx18-dvb.c

+10 −8
Original line number Diff line number Diff line
@@ -213,10 +213,14 @@ static int cx18_dvb_start_feed(struct dvb_demux_feed *feed) 
{

	struct dvb_demux *demux = feed->demux;

	struct cx18_stream *stream = (struct cx18_stream *) demux->priv;

	struct cx18 *cx = stream->cx;

	struct cx18 *cx;

	int ret;

	u32 v;



	if (!stream)

		return -EINVAL;



	cx = stream->cx;

	CX18_DEBUG_INFO("Start feed: pid = 0x%x index = %d\n",

			feed->pid, feed->index);
@@ -253,9 +257,6 @@ static int cx18_dvb_start_feed(struct dvb_demux_feed *feed) 
	if (!demux->dmx.frontend)

		return -EINVAL;



	if (!stream)

		return -EINVAL;



	mutex_lock(&stream->dvb.feedlock);

	if (stream->dvb.feeding++ == 0) {

		CX18_DEBUG_INFO("Starting Transport DMA\n");
@@ -279,13 +280,14 @@ static int cx18_dvb_stop_feed(struct dvb_demux_feed *feed) 
{

	struct dvb_demux *demux = feed->demux;

	struct cx18_stream *stream = (struct cx18_stream *)demux->priv;

	struct cx18 *cx = stream->cx;

	struct cx18 *cx;

	int ret = -EINVAL;



	if (stream) {

		cx = stream->cx;

		CX18_DEBUG_INFO("Stop feed: pid = 0x%x index = %d\n",

				feed->pid, feed->index);



	if (stream) {

		mutex_lock(&stream->dvb.feedlock);

		if (--stream->dvb.feeding == 0) {

			CX18_DEBUG_INFO("Stopping Transport DMA\n");