Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4682b58e authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab
Browse files

[media] qt1010: avoid going past array 



As reported by smatch:
	drivers/media/tuners/qt1010.c:357 qt1010_init() error: buffer overflow 'i2c_data' 34 <= 34

This should not happen with the current code, as the i2c_data array
doesn't end with a QT1010_M1, but it doesn't hurt add a BUG_ON
to notify if one modifies it and breaks.

Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
parent 322583c4

drivers/media/tuners/qt1010.c

+5 −1
Original line number Original line Diff line number Diff line
@@ -354,13 +354,17 @@ static int qt1010_init(struct dvb_frontend *fe) 
				valptr = &priv->reg1f_init_val;

				valptr = &priv->reg1f_init_val;

			else

			else

				valptr = &tmpval;

				valptr = &tmpval;



			BUG_ON(i >= ARRAY_SIZE(i2c_data) - 1);



			err = qt1010_init_meas1(priv, i2c_data[i+1].reg,

			err = qt1010_init_meas1(priv, i2c_data[i+1].reg,

						i2c_data[i].reg,

						i2c_data[i].reg,

						i2c_data[i].val, valptr);

						i2c_data[i].val, valptr);

			i++;

			i++;

			break;

			break;

		}

		}

		if (err) return err;

		if (err)

			return err;

	}

	}





	for (i = 0x31; i < 0x3a; i++) /* 0x31 - 0x39 */

	for (i = 0x31; i < 0x3a; i++) /* 0x31 - 0x39 */