From patchwork Sun Jan 6 17:28:10 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 1937901 Return-Path: X-Original-To: patchwork-linux-media@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork1.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork1.kernel.org (Postfix) with ESMTP id 447EC3FC85 for ; Sun, 6 Jan 2013 17:28:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756067Ab3AFR2n (ORCPT ); Sun, 6 Jan 2013 12:28:43 -0500 Received: from mx1.redhat.com ([209.132.183.28]:50609 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753067Ab3AFR2n (ORCPT ); Sun, 6 Jan 2013 12:28:43 -0500 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r06HSfVH000875 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Sun, 6 Jan 2013 12:28:41 -0500 Received: from localhost.localdomain (vpn1-6-252.gru2.redhat.com [10.97.6.252]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id r06HSeVn029969; Sun, 6 Jan 2013 12:28:41 -0500 Date: Sun, 6 Jan 2013 15:28:10 -0200 From: Mauro Carvalho Chehab To: Nickolai Zeldovich , LMML Subject: Fw: [PATCH] media: cx18, ivtv: do not dereference array before index check Message-ID: <20130106152810.4a6493e2@redhat.com> Mime-Version: 1.0 X-Scanned-By: MIMEDefang 2.68 on 10.5.11.23 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org This one also didn't arrive. I only noticed those two messages because I cleaned today my patchwork's queue and didn't notice them arriving at patchwork on linuxtv.org. Regards, Mauro Forwarded message: Date: Sat, 5 Jan 2013 14:11:56 -0500 From: Nickolai Zeldovich To: Andy Walls , Mauro Carvalho Chehab Cc: Nickolai Zeldovich , linux-kernel@vger.kernel.org, linux-media@vger.kernel.org Subject: [PATCH] media: cx18, ivtv: do not dereference array before index check Move dereferencing of hw_devicenames[], hw_bus[] arrays until after checking that idx is within range. Signed-off-by: Nickolai Zeldovich --- drivers/media/pci/cx18/cx18-i2c.c | 10 +++++++--- drivers/media/pci/ivtv/ivtv-i2c.c | 5 ++++- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/media/pci/cx18/cx18-i2c.c b/drivers/media/pci/cx18/cx18-i2c.c index 4908eb7..d164239 100644 --- a/drivers/media/pci/cx18/cx18-i2c.c +++ b/drivers/media/pci/cx18/cx18-i2c.c @@ -111,14 +111,18 @@ static int cx18_i2c_new_ir(struct cx18 *cx, struct i2c_adapter *adap, u32 hw, int cx18_i2c_register(struct cx18 *cx, unsigned idx) { struct v4l2_subdev *sd; - int bus = hw_bus[idx]; - struct i2c_adapter *adap = &cx->i2c_adap[bus]; - const char *type = hw_devicenames[idx]; + int bus; + struct i2c_adapter *adap; + const char *type; u32 hw = 1 << idx; if (idx >= ARRAY_SIZE(hw_addrs)) return -1; + bus = hw_bus[idx]; + adap = &cx->i2c_adap[bus]; + type = hw_devicenames[idx]; + if (hw == CX18_HW_TUNER) { /* special tuner group handling */ sd = v4l2_i2c_new_subdev(&cx->v4l2_dev, diff --git a/drivers/media/pci/ivtv/ivtv-i2c.c b/drivers/media/pci/ivtv/ivtv-i2c.c index 46e262b..c6af94c 100644 --- a/drivers/media/pci/ivtv/ivtv-i2c.c +++ b/drivers/media/pci/ivtv/ivtv-i2c.c @@ -264,11 +264,14 @@ int ivtv_i2c_register(struct ivtv *itv, unsigned idx) { struct v4l2_subdev *sd; struct i2c_adapter *adap = &itv->i2c_adap; - const char *type = hw_devicenames[idx]; + const char *type; u32 hw = 1 << idx; if (idx >= ARRAY_SIZE(hw_addrs)) return -1; + + type = hw_devicenames[idx]; + if (hw == IVTV_HW_TUNER) { /* special tuner handling */ sd = v4l2_i2c_new_subdev(&itv->v4l2_dev, adap, type, 0,