From patchwork Thu May 26 08:44:52 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 820132 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter2.kernel.org (8.14.4/8.14.3) with ESMTP id p4Q8jTBo007854 for ; Thu, 26 May 2011 08:45:29 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755791Ab1EZIpX (ORCPT ); Thu, 26 May 2011 04:45:23 -0400 Received: from mail-bw0-f46.google.com ([209.85.214.46]:37230 "EHLO mail-bw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751731Ab1EZIpV (ORCPT ); Thu, 26 May 2011 04:45:21 -0400 Received: by bwz15 with SMTP id 15so249511bwz.19 for ; Thu, 26 May 2011 01:45:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:date:from:to:cc:subject:message-id:mime-version :content-type:content-disposition:user-agent; bh=pYcd6E1Joc9rgx6kUVLA/sDLdEkFIPnLzbmz4IdjUFA=; b=Td35VAYfzRz9JXT3F87V2hTkc6KIFsCWkXP9tLjcoU9tiomAX1dLTglQT2s+RNk0Ri 4RtCsO65gsH1/WQ5lV3/+k0DLlppMDCHUPVWrzbB5vfYxAkvirksyp2zSaLb6qoNjDFg Qadlhyogg7czghbRUcM7KWuekBlzc9NGlkEbM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:mime-version:content-type :content-disposition:user-agent; b=nB2Tilej7Hxi6ougg7qAdWgzcv8T7IsbvTzaipY24hvVIdIfVAKwBvANYJLYLv5xfv U0YveMziUf9rJZK48DFlwHyIU3F9UkTw8jYsWGEpq/Qk3PtBrvuIaHdpkMm792ezDeoS Ri062kgK9HPafOmTNDAJOKaumgdDDf0iSQtRY= Received: by 10.204.15.139 with SMTP id k11mr388042bka.49.1306399519921; Thu, 26 May 2011 01:45:19 -0700 (PDT) Received: from shale.localdomain ([212.49.88.34]) by mx.google.com with ESMTPS id l24sm277408bkw.15.2011.05.26.01.45.13 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 26 May 2011 01:45:18 -0700 (PDT) Date: Thu, 26 May 2011 11:44:52 +0300 From: Dan Carpenter To: Mauro Carvalho Chehab Cc: Andreas Oberritter , Arnd Bergmann , Steven Toth , Lucas De Marchi , linux-media@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] [media] DVB: dvb_frontend: off by one in dtv_property_dump() Message-ID: <20110526084452.GB14591@shale.localdomain> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter2.kernel.org [140.211.167.43]); Thu, 26 May 2011 08:45:29 +0000 (UTC) If the tvp->cmd == DTV_MAX_COMMAND then we read past the end of the array. Signed-off-by: Dan Carpenter --- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c index 9827804..607e293 100644 --- a/drivers/media/dvb/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb/dvb-core/dvb_frontend.c @@ -981,7 +981,7 @@ static void dtv_property_dump(struct dtv_property *tvp) { int i; - if (tvp->cmd <= 0 || tvp->cmd > DTV_MAX_COMMAND) { + if (tvp->cmd <= 0 || tvp->cmd >= DTV_MAX_COMMAND) { printk(KERN_WARNING "%s: tvp.cmd = 0x%08x undefined\n", __func__, tvp->cmd); return;