[media] mb86a20s: fix audio sub-channel check
authorMauro Carvalho Chehab <mchehab@redhat.com>
Sun, 7 Apr 2013 23:51:32 +0000 (20:51 -0300)
committerMauro Carvalho Chehab <mchehab@redhat.com>
Mon, 8 Apr 2013 10:10:33 +0000 (07:10 -0300)
As reported by Dan Carpenter <dan.carpenter@oracle.com>
FYI, there are new smatch warnings show up in:
tree:   git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next master
head:   da17d7bda957ae4697b6abc0793f74fb9b50b58f
commit: 04fa725e7b1c22c583dd71a8cd85b8d997edfce3 [media] mb86a20s: Implement set_frontend cache logic
New smatch warnings:
drivers/media/dvb-frontends/mb86a20s.c:1897 mb86a20s_set_frontend() error: buffer overflow 'mb86a20s_subchannel' 8 <= 8
04fa725e Mauro Carvalho Chehab 2013-03-04  1894   if (c->isdbt_sb_subchannel > ARRAY_SIZE(mb86a20s_subchannel))
04fa725e Mauro Carvalho Chehab 2013-03-04  1895   c->isdbt_sb_subchannel = 0;
04fa725e Mauro Carvalho Chehab 2013-03-04  1896
04fa725e Mauro Carvalho Chehab 2013-03-04 @1897   state->subchannel = mb86a20s_subchannel[c->isdbt_sb_subchannel];

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
drivers/media/dvb-frontends/mb86a20s.c

index 80a8ee090c80feeb250819dff86ee4dffd810ad2..70158aae1886122c7197a022893e5d90dac77003 100644 (file)
@@ -1915,7 +1915,7 @@ static int mb86a20s_set_frontend(struct dvb_frontend *fe)
        if (!c->isdbt_sb_mode) {
                state->subchannel = 0;
        } else {
-               if (c->isdbt_sb_subchannel > ARRAY_SIZE(mb86a20s_subchannel))
+               if (c->isdbt_sb_subchannel >= ARRAY_SIZE(mb86a20s_subchannel))
                        c->isdbt_sb_subchannel = 0;
 
                state->subchannel = mb86a20s_subchannel[c->isdbt_sb_subchannel];