V4L/DVB (4488): Fix possible crash in Hauppauge eeprom reading

If an eeprom defined two tuners and they supported more than eight
standards combined (as opposed to each), it would overflow an array.

Signed-off-by: Trent Piepho <xyzzy@speakeasy.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c
index d95529e8e51376dbadeea8e89f94ab770769cf6d..cd1502ac956056f5e0e461b3b7fcdeac076d25f4 100644 (file)
--- a/drivers/media/video/tveeprom.c
+++ b/drivers/media/video/tveeprom.c
@@ -605,6 +605,8 @@ void tveeprom_hauppauge_analog(struct i2c_client *c, struct tveeprom *tvee,
                        tvee->tuner_formats |= hauppauge_tuner_fmt[i].id;
                        t_fmt_name1[j++] = hauppauge_tuner_fmt[i].name;
                }
+       }
+       for (i = j = 0; i < 8; i++) {
                if (t_format2 & (1 << i)) {
                        tvee->tuner2_formats |= hauppauge_tuner_fmt[i].id;
                        t_fmt_name2[j++] = hauppauge_tuner_fmt[i].name;