Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 225aeb1c authored by Andy Walls's avatar Andy Walls Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB (12338): cx18: Read buffer overflow 



This mistakenly tested against sizeof(freqs) instead of the array size. Due to
the mask the only illegal value possible was 3.

Reported-by: default avatarRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: default avatarAndy Walls <awalls@radix.net>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent ed18d0c8

drivers/media/video/cx18/cx18-controls.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -20,6 +20,7 @@ 
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA

 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA

 *  02111-1307  USA

 *  02111-1307  USA

 */

 */

#include <linux/kernel.h>





#include "cx18-driver.h"

#include "cx18-driver.h"

#include "cx18-cards.h"

#include "cx18-cards.h"
@@ -317,7 +318,7 @@ int cx18_s_ext_ctrls(struct file *file, void *fh, struct v4l2_ext_controls *c) 
		idx = p.audio_properties & 0x03;

		idx = p.audio_properties & 0x03;

		/* The audio clock of the digitizer must match the codec sample

		/* The audio clock of the digitizer must match the codec sample

		   rate otherwise you get some very strange effects. */

		   rate otherwise you get some very strange effects. */

		if (idx < sizeof(freqs))

		if (idx < ARRAY_SIZE(freqs))

			cx18_call_all(cx, audio, s_clock_freq, freqs[idx]);

			cx18_call_all(cx, audio, s_clock_freq, freqs[idx]);

		return err;

		return err;

	}

	}