From patchwork Wed Apr 29 23:05:46 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mauro Carvalho Chehab X-Patchwork-Id: 6299021 Return-Path: X-Original-To: patchwork-linux-media@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 2BB00BEEE1 for ; Wed, 29 Apr 2015 23:06:54 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 90478201B4 for ; Wed, 29 Apr 2015 23:06:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A66EF201CD for ; Wed, 29 Apr 2015 23:06:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751733AbbD2XGq (ORCPT ); Wed, 29 Apr 2015 19:06:46 -0400 Received: from bombadil.infradead.org ([198.137.202.9]:37639 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751586AbbD2XG0 (ORCPT ); Wed, 29 Apr 2015 19:06:26 -0400 Received: from [200.101.47.138] (helo=smtp.w2.samsung.com) by bombadil.infradead.org with esmtpsa (Exim 4.80.1 #2 (Red Hat Linux)) id 1Ynb3h-0005BR-JG; Wed, 29 Apr 2015 23:06:25 +0000 Received: from mchehab by smtp.w2.samsung.com with local (Exim 4.84) (envelope-from ) id 1Ynb3W-0005CB-39; Wed, 29 Apr 2015 20:06:14 -0300 From: Mauro Carvalho Chehab To: Linux Media Mailing List Cc: Mauro Carvalho Chehab , Mauro Carvalho Chehab , Antti Palosaari Subject: [PATCH 01/27] qt1010: avoid going past array Date: Wed, 29 Apr 2015 20:05:46 -0300 Message-Id: <89e5bc8de1ae960f10bd5ea465e7e4f7c6b8812a.1430348725.git.mchehab@osg.samsung.com> X-Mailer: git-send-email 2.1.0 Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP As reported by smatch: drivers/media/tuners/qt1010.c:357 qt1010_init() error: buffer overflow 'i2c_data' 34 <= 34 This should not happen with the current code, as the i2c_data array doesn't end with a QT1010_M1, but it doesn't hurt add a BUG_ON to notify if one modifies it and breaks. Signed-off-by: Mauro Carvalho Chehab diff --git a/drivers/media/tuners/qt1010.c b/drivers/media/tuners/qt1010.c index 74b6b17cdbaf..ae8cbece6d2b 100644 --- a/drivers/media/tuners/qt1010.c +++ b/drivers/media/tuners/qt1010.c @@ -354,13 +354,17 @@ static int qt1010_init(struct dvb_frontend *fe) valptr = &priv->reg1f_init_val; else valptr = &tmpval; + + BUG_ON(i >= ARRAY_SIZE(i2c_data) - 1); + err = qt1010_init_meas1(priv, i2c_data[i+1].reg, i2c_data[i].reg, i2c_data[i].val, valptr); i++; break; } - if (err) return err; + if (err) + return err; } for (i = 0x31; i < 0x3a; i++) /* 0x31 - 0x39 */