Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8aab72bb authored by Hans Verkuil's avatar Hans Verkuil Committed by Mauro Carvalho Chehab
Browse files

[media] si4713: si4713_set_rds_radio_text overwrites terminating \0 



si4713_set_rds_radio_text will overwrite the terminating zero at the
end of the rds radio text string in order to send out a carriage return
as per the RDS spec.
Use a separate char buffer for the CR instead of corrupting the control
string.

Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Tested-by: default avatarEduardo Valentin <edubezval@gmail.com>
Acked-by: default avatarEduardo Valentin <edubezval@gmail.com>
Signed-off-by: default avatarMauro Carvalho Chehab <m.chehab@samsung.com>
parent cc6d618f

drivers/media/radio/si4713/si4713.c

+3 −2
Original line number Diff line number Diff line
@@ -831,8 +831,9 @@ static int si4713_set_rds_ps_name(struct si4713_device *sdev, char *ps_name) 
	return rval;

}



static int si4713_set_rds_radio_text(struct si4713_device *sdev, char *rt)

static int si4713_set_rds_radio_text(struct si4713_device *sdev, const char *rt)

{

	static const char cr[RDS_RADIOTEXT_BLK_SIZE] = { RDS_CARRIAGE_RETURN, 0 };

	int rval = 0, i;

	u16 t_index = 0;

	u8 b_index = 0, cr_inserted = 0;
@@ -856,7 +857,7 @@ static int si4713_set_rds_radio_text(struct si4713_device *sdev, char *rt) 
			for (i = 0; i < RDS_RADIOTEXT_BLK_SIZE; i++) {

				if (!rt[t_index + i] ||

				    rt[t_index + i] == RDS_CARRIAGE_RETURN) {

					rt[t_index + i] = RDS_CARRIAGE_RETURN;

					rt = cr;

					cr_inserted = 1;

					break;

				}