| Message ID | 20130212122208.GA19045@elgon.mountain (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Tue, Feb 12, 2013 at 03:22:08PM +0300, Dan Carpenter wrote: >Smatch complains that "cmdbuf[cmdcount - length]" might go past the end >of the array. It's an easy warning to silence by moving the limit >check earlier. > >Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Looks ok. I'll leave the signing off to Jarod though. I've just dabbled in the driver but I'm not the maintainer. >diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c >index bdd1ed8..5b5b6e6 100644 >--- a/drivers/media/rc/mceusb.c >+++ b/drivers/media/rc/mceusb.c >@@ -828,16 +828,16 @@ static int mceusb_tx_ir(struct rc_dev *dev, unsigned *txbuf, unsigned count) > (txbuf[i] -= MCE_MAX_PULSE_LENGTH)); > } > >- /* Fix packet length in last header */ >- length = cmdcount % MCE_CODE_LENGTH; >- cmdbuf[cmdcount - length] -= MCE_CODE_LENGTH - length; >- > /* Check if we have room for the empty packet at the end */ > if (cmdcount >= MCE_CMDBUF_SIZE) { > ret = -EINVAL; > goto out; > } > >+ /* Fix packet length in last header */ >+ length = cmdcount % MCE_CODE_LENGTH; >+ cmdbuf[cmdcount - length] -= MCE_CODE_LENGTH - length; >+ > /* All mce commands end with an empty packet (0x80) */ > cmdbuf[cmdcount++] = MCE_IRDATA_TRAILER; > >
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c index bdd1ed8..5b5b6e6 100644 --- a/drivers/media/rc/mceusb.c +++ b/drivers/media/rc/mceusb.c @@ -828,16 +828,16 @@ static int mceusb_tx_ir(struct rc_dev *dev, unsigned *txbuf, unsigned count) (txbuf[i] -= MCE_MAX_PULSE_LENGTH)); } - /* Fix packet length in last header */ - length = cmdcount % MCE_CODE_LENGTH; - cmdbuf[cmdcount - length] -= MCE_CODE_LENGTH - length; - /* Check if we have room for the empty packet at the end */ if (cmdcount >= MCE_CMDBUF_SIZE) { ret = -EINVAL; goto out; } + /* Fix packet length in last header */ + length = cmdcount % MCE_CODE_LENGTH; + cmdbuf[cmdcount - length] -= MCE_CODE_LENGTH - length; + /* All mce commands end with an empty packet (0x80) */ cmdbuf[cmdcount++] = MCE_IRDATA_TRAILER;
Smatch complains that "cmdbuf[cmdcount - length]" might go past the end of the array. It's an easy warning to silence by moving the limit check earlier. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html