diff mbox

[1/1] Reading array out of bound in ds3000_read_snr

Message ID 1393513253-10723-1-git-send-email-xypron.glpk@gmx.de (mailing list archive)
State New, archived
Headers show

Commit Message

Heinrich Schuchardt Feb. 27, 2014, 3 p.m. UTC 
From: Heinrich Schuchardt <xypron.glpk@gmx.de>

An attempt was made to read dvbs2_snr_tab[80],
though dvbs2_snr_tab has only 80 elements.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
---
 drivers/media/dvb-frontends/ds3000.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox

Patch

diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c
index 1e344b0..335daef 100644
--- a/drivers/media/dvb-frontends/ds3000.c
+++ b/drivers/media/dvb-frontends/ds3000.c
@@ -616,7 +616,7 @@  static int ds3000_read_snr(struct dvb_frontend *fe, u16 *snr)
 			snr_reading = dvbs2_noise_reading / tmp;
 			if (snr_reading > 80)
 				snr_reading = 80;
-			*snr = -(dvbs2_snr_tab[snr_reading] / 1000);
+			*snr = -(dvbs2_snr_tab[snr_reading - 1] / 1000);
 		}
 		dprintk("%s: raw / cooked = 0x%02x / 0x%04x\n", __func__,
 				snr_reading, *snr);