[media] dvb_frontend: Fix possible read out of bounds

Check if index is within bounds _before_ accessing the value.

Signed-off-by: Ole Ernst <olebowle@gmx.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index 2d32c13ade7bcdfbd82492fc7511094f34c74a4f..6ce435ac866f06d5689f3ee9f71a0d91c9ade143 100644 (file)
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -1279,7 +1279,7 @@ static int dtv_property_process_get(struct dvb_frontend *fe,
        switch(tvp->cmd) {
        case DTV_ENUM_DELSYS:
                ncaps = 0;
-               while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) {
+               while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {
                        tvp->u.buffer.data[ncaps] = fe->ops.delsys[ncaps];
                        ncaps++;
                }
@@ -1596,7 +1596,7 @@ static int dvbv5_set_delivery_system(struct dvb_frontend *fe,
         * supported
         */
        ncaps = 0;
-       while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) {
+       while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {
                if (fe->ops.delsys[ncaps] == desired_system) {
                        c->delivery_system = desired_system;
                        dev_dbg(fe->dvb->device,
@@ -1628,7 +1628,7 @@ static int dvbv5_set_delivery_system(struct dvb_frontend *fe,
        * of the desired system
        */
        ncaps = 0;
-       while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) {
+       while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {
                if (dvbv3_type(fe->ops.delsys[ncaps]) == type)
                        delsys = fe->ops.delsys[ncaps];
                ncaps++;
@@ -1703,7 +1703,7 @@ static int dvbv3_set_delivery_system(struct dvb_frontend *fe)
         * DVBv3 standard
         */
        ncaps = 0;
-       while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) {
+       while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {
                if (dvbv3_type(fe->ops.delsys[ncaps]) != DVBV3_UNKNOWN) {
                        delsys = fe->ops.delsys[ncaps];
                        break;