V4L/DVB (4488): Fix possible crash in Hauppauge eeprom reading
authorTrent Piepho <xyzzy@speakeasy.org>
Mon, 7 Aug 2006 22:43:21 +0000 (19:43 -0300)
committerMauro Carvalho Chehab <mchehab@infradead.org>
Tue, 26 Sep 2006 15:30:31 +0000 (12:30 -0300)
If an eeprom defined two tuners and they supported more than eight
standards combined (as opposed to each), it would overflow an array.

Signed-off-by: Trent Piepho <xyzzy@speakeasy.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
drivers/media/video/tveeprom.c

index d95529e8e51376dbadeea8e89f94ab770769cf6d..cd1502ac956056f5e0e461b3b7fcdeac076d25f4 100644 (file)
@@ -605,6 +605,8 @@ void tveeprom_hauppauge_analog(struct i2c_client *c, struct tveeprom *tvee,
                        tvee->tuner_formats |= hauppauge_tuner_fmt[i].id;
                        t_fmt_name1[j++] = hauppauge_tuner_fmt[i].name;
                }
+       }
+       for (i = j = 0; i < 8; i++) {
                if (t_format2 & (1 << i)) {
                        tvee->tuner2_formats |= hauppauge_tuner_fmt[i].id;
                        t_fmt_name2[j++] = hauppauge_tuner_fmt[i].name;