dvb: Fix integer overflow bug
PATCH 17/37 dvb: Fix integer overflow bug
From: Johannes Stezenbach <[email protected]>
Fix integer overflow bug in read_signal_strength() reported by Anthony Leclerc.
Signed-off-by Johannes Stezenbach <[email protected]>
Signed-off-by Michael Krufky <[email protected]>
drivers/media/dvb/frontends/or51132.c | 7 ++++++- drivers/media/dvb/frontends/or51211.c | 8 ++++++-- 2 files changed, 12 insertions(+), 3 deletions(-)
drivers/media/dvb/frontends/or51132.c +6 -1
@@ -468,6 +468,7 @@unsigned char snd_buf[2 ];u8 rcvr_stat;u16 snr_equ; +u32 signal_strength;int usK; snd_buf[0 ]=0x04 ;
@@ -503,7 +504,11 @@ usK = (rcvr_stat &0x10 ) ?3 :0 ;/* The value reported back from the frontend will be FFFF=100% 0000=0% */ - *strength = (((8952 -i20Log10 (snr_equ) - usK*100 )/3 +5 )*65535 )/1000 ; + signal_strength = (((8952 -i20Log10 (snr_equ) - usK*100 )/3 +5 )*65535 )/1000 ; +if (signal_strength >0xffff ) + *strength =0xffff ; +else + *strength = signal_strength;dprintk ("read_signal_strength %i\n" ,*strength);return 0 ;
drivers/media/dvb/frontends/or51211.c +6 -2
@@ -339,6 +339,7 @@u8 rec_buf[2 ];u8 snd_buf[4 ];u8 snr_equ; +u32 signal_strength;/* SNR after Equalizer */ snd_buf[0 ] =0x04 ;
@@ -358,8 +359,11 @@ snr_equ = rec_buf[0 ] &0xff ;/* The value reported back from the frontend will be FFFF=100% 0000=0% */ - *strength = (((5334 -i20Log10 (snr_equ))/3 +5 )*65535 )/1000 ; - + signal_strength = (((5334 -i20Log10 (snr_equ))/3 +5 )*65535 )/1000 ; +if (signal_strength >0xffff ) + *strength =0xffff ; +else + *strength = signal_strength;dprintk ("read_signal_strength %i\n" ,*strength);return 0 ;