Skip to contentSkip to conversation

tuner-simple: possible read buffer overflow?

PATCH In review Roel Kluin 2 participants 2 messages Oct 3, 2009 Media (V4L/DVB)

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 tuner-simple: possible read buffer overflow?

Prevent read from t_params->ranges[-1].

Signed-off-by Roel Kluin <[email protected]>

---
This is only required when t_params->count can be 0, can it?

Roel

drivers/media/common/tuners/tuner-simple.c +1 -1
index 8abbcc5..e679d5f 100644
@@ -266,7 +266,7 @@ static int simple_config_lookup(struct dvb_frontend *fe,
 			continue;
 		break;
 	}
-	if (i == t_params->count) {
+	if (i == t_params->count && i) {
 		tuner_dbg("frequency out of range (%d > %d)\n",
 			  *frequency, t_params->ranges[i - 1].limit);
 		*frequency = t_params->ranges[--i].limit;
#1 lore raw
Quoted 5 lines · Roel Kluin

Prevent read from t_params->ranges[-1].

Signed-off-by Roel Kluin <[email protected]>

---
This is only required when t_params->count can be 0, can it?

Shouldn't be possible, or the tuner would be useless.

Quoted 5 lines
drivers/media/common/tuners/tuner-simple.c +1 -1
-	if (i == t_params->count) {
+	if (i == t_params->count && i) {
 		tuner_dbg("frequency out of range (%d > %d)\n",
 			  *frequency, t_params->ranges[i - 1].limit);
 		*frequency = t_params->ranges[--i].limit;