diff mbox

[media] DVB: dvb_frontend: off by one in dtv_property_dump()

Message ID 20110526084452.GB14591@shale.localdomain (mailing list archive)
State Accepted
Headers show

Commit Message

Dan Carpenter May 26, 2011, 8:44 a.m. UTC 
If the tvp->cmd == DTV_MAX_COMMAND then we read past the end of the
array.

Signed-off-by: Dan Carpenter <error27@gmail.com>

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 9827804..607e293 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -981,7 +981,7 @@  static void dtv_property_dump(struct dtv_property *tvp)
 {
 	int i;
 
-	if (tvp->cmd <= 0 || tvp->cmd > DTV_MAX_COMMAND) {
+	if (tvp->cmd <= 0 || tvp->cmd >= DTV_MAX_COMMAND) {
 		printk(KERN_WARNING "%s: tvp.cmd = 0x%08x undefined\n",
 			__func__, tvp->cmd);
 		return;