From patchwork Mon Feb 22 19:09:17 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 8382221 Return-Path: X-Original-To: patchwork-linux-media@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id DFA949F7C9 for ; Mon, 22 Feb 2016 19:09:38 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 082542058E for ; Mon, 22 Feb 2016 19:09:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 11013205BC for ; Mon, 22 Feb 2016 19:09:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752668AbcBVTJf (ORCPT ); Mon, 22 Feb 2016 14:09:35 -0500 Received: from bombadil.infradead.org ([198.137.202.9]:37554 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752600AbcBVTJc (ORCPT ); Mon, 22 Feb 2016 14:09:32 -0500 Received: from [179.182.161.166] (helo=smtp.w2.samsung.com) by bombadil.infradead.org with esmtpsa (Exim 4.80.1 #2 (Red Hat Linux)) id 1aXvrO-0004Ol-K7; Mon, 22 Feb 2016 19:09:30 +0000 Received: from mchehab by smtp.w2.samsung.com with local (Exim 4.86) (envelope-from ) id 1aXvrJ-00085S-5B; Mon, 22 Feb 2016 16:09:25 -0300 From: Mauro Carvalho Chehab Cc: Mauro Carvalho Chehab , Linux Media Mailing List , Mauro Carvalho Chehab , Stefan Richter , Michael Ira Krufky Subject: [PATCH 3/9] [media] stv0900: avoid going past array Date: Mon, 22 Feb 2016 16:09:17 -0300 Message-Id: X-Mailer: git-send-email 2.5.0 In-Reply-To: <4340d9c3cc750cc30918b5de6bf16de2722f7d1b.1456167652.git.mchehab@osg.samsung.com> References: <4340d9c3cc750cc30918b5de6bf16de2722f7d1b.1456167652.git.mchehab@osg.samsung.com> In-Reply-To: <4340d9c3cc750cc30918b5de6bf16de2722f7d1b.1456167652.git.mchehab@osg.samsung.com> References: <4340d9c3cc750cc30918b5de6bf16de2722f7d1b.1456167652.git.mchehab@osg.samsung.com> To: unlisted-recipients:; (no To-header on input) Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Fix the following smatch warnings: drivers/media/dvb-frontends/stv0900_core.c:1183 stv0900_get_optim_carr_loop() error: buffer overflow 'cllas2' 11 <= 13 drivers/media/dvb-frontends/stv0900_core.c:1185 stv0900_get_optim_carr_loop() error: buffer overflow 'cllas2' 11 <= 13 drivers/media/dvb-frontends/stv0900_core.c:1187 stv0900_get_optim_carr_loop() error: buffer overflow 'cllas2' 11 <= 13 drivers/media/dvb-frontends/stv0900_core.c:1189 stv0900_get_optim_carr_loop() error: buffer overflow 'cllas2' 11 <= 13 drivers/media/dvb-frontends/stv0900_core.c:1191 stv0900_get_optim_carr_loop() error: buffer overflow 'cllas2' 11 <= 13 Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Michael Ira Krufky --- drivers/media/dvb-frontends/stv0900_core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/media/dvb-frontends/stv0900_core.c b/drivers/media/dvb-frontends/stv0900_core.c index 28239b1fd954..f667005a6661 100644 --- a/drivers/media/dvb-frontends/stv0900_core.c +++ b/drivers/media/dvb-frontends/stv0900_core.c @@ -1087,7 +1087,7 @@ u8 stv0900_get_optim_carr_loop(s32 srate, enum fe_stv0900_modcode modcode, s32 pilot, u8 chip_id) { u8 aclc_value = 0x29; - s32 i; + s32 i, cllas2_size; const struct stv0900_car_loop_optim *cls2, *cllqs2, *cllas2; dprintk("%s\n", __func__); @@ -1096,14 +1096,17 @@ u8 stv0900_get_optim_carr_loop(s32 srate, enum fe_stv0900_modcode modcode, cls2 = FE_STV0900_S2CarLoop; cllqs2 = FE_STV0900_S2LowQPCarLoopCut30; cllas2 = FE_STV0900_S2APSKCarLoopCut30; + cllas2_size = ARRAY_SIZE(FE_STV0900_S2APSKCarLoopCut30); } else if (chip_id == 0x20) { cls2 = FE_STV0900_S2CarLoopCut20; cllqs2 = FE_STV0900_S2LowQPCarLoopCut20; cllas2 = FE_STV0900_S2APSKCarLoopCut20; + cllas2_size = ARRAY_SIZE(FE_STV0900_S2APSKCarLoopCut20); } else { cls2 = FE_STV0900_S2CarLoopCut30; cllqs2 = FE_STV0900_S2LowQPCarLoopCut30; cllas2 = FE_STV0900_S2APSKCarLoopCut30; + cllas2_size = ARRAY_SIZE(FE_STV0900_S2APSKCarLoopCut30); } if (modcode < STV0900_QPSK_12) { @@ -1178,7 +1181,7 @@ u8 stv0900_get_optim_carr_loop(s32 srate, enum fe_stv0900_modcode modcode, aclc_value = cls2[i].car_loop_pilots_off_30; } - } else { + } else if (i < cllas2_size) { if (srate <= 3000000) aclc_value = cllas2[i].car_loop_pilots_on_2; else if (srate <= 7000000)