Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b90ed914 authored by Johannes Stezenbach's avatar Johannes Stezenbach Committed by Linus Torvalds
Browse files

[PATCH] dvb: Fix integer overflow bug 



Fix integer overflow bug in read_signal_strength() reported by Anthony
Leclerc.

Signed-off-by: default avatarJohannes Stezenbach <js@linuxtv.org>
Signed-off-by: default avatarMichael Krufky <mkrufky@linuxtv.org>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 5c15c0b4

drivers/media/dvb/frontends/or51132.c

+6 −1
Original line number Diff line number Diff line
@@ -468,6 +468,7 @@ static int or51132_read_signal_strength(struct dvb_frontend* fe, u16* strength) 
	unsigned char snd_buf[2];

	u8 rcvr_stat;

	u16 snr_equ;

	u32 signal_strength;

	int usK;



	snd_buf[0]=0x04;
@@ -503,7 +504,11 @@ static int or51132_read_signal_strength(struct dvb_frontend* fe, u16* strength) 
	usK = (rcvr_stat & 0x10) ? 3 : 0;



        /* The value reported back from the frontend will be FFFF=100% 0000=0% */

	*strength = (((8952 - i20Log10(snr_equ) - usK*100)/3+5)*65535)/1000;

	signal_strength = (((8952 - i20Log10(snr_equ) - usK*100)/3+5)*65535)/1000;

	if (signal_strength > 0xffff)

		*strength = 0xffff;

	else

		*strength = signal_strength;

	dprintk("read_signal_strength %i\n",*strength);



	return 0;

drivers/media/dvb/frontends/or51211.c

+6 −2
Original line number Diff line number Diff line
@@ -339,6 +339,7 @@ static int or51211_read_signal_strength(struct dvb_frontend* fe, u16* strength) 
	u8 rec_buf[2];

	u8 snd_buf[4];

	u8 snr_equ;

	u32 signal_strength;



	/* SNR after Equalizer */

	snd_buf[0] = 0x04;
@@ -358,8 +359,11 @@ static int or51211_read_signal_strength(struct dvb_frontend* fe, u16* strength) 
	snr_equ = rec_buf[0] & 0xff;



	/* The value reported back from the frontend will be FFFF=100% 0000=0% */

	*strength = (((5334 - i20Log10(snr_equ))/3+5)*65535)/1000;



	signal_strength = (((5334 - i20Log10(snr_equ))/3+5)*65535)/1000;

	if (signal_strength > 0xffff)

		*strength = 0xffff;

	else

		*strength = signal_strength;

	dprintk("read_signal_strength %i\n",*strength);



	return 0;