From: Heinrich Schuchardt Date: Fri, 28 Feb 2014 02:04:08 +0000 (-0300) Subject: [media] ds3000: fix reading array out of bound in ds3000_read_snr X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=b59de95bed526467f21c9978460cb15952b462e8;p=GitHub%2Fexynos8895%2Fandroid_kernel_samsung_universal8895.git [media] ds3000: fix reading array out of bound in ds3000_read_snr An attempt was made to read dvbs2_snr_tab[80], though dvbs2_snr_tab has only 80 elements. Signed-off-by: Heinrich Schuchardt Signed-off-by: Michael Krufky Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c index 1e344b033277..335daeff91b9 100644 --- a/drivers/media/dvb-frontends/ds3000.c +++ b/drivers/media/dvb-frontends/ds3000.c @@ -616,7 +616,7 @@ static int ds3000_read_snr(struct dvb_frontend *fe, u16 *snr) snr_reading = dvbs2_noise_reading / tmp; if (snr_reading > 80) snr_reading = 80; - *snr = -(dvbs2_snr_tab[snr_reading] / 1000); + *snr = -(dvbs2_snr_tab[snr_reading - 1] / 1000); } dprintk("%s: raw / cooked = 0x%02x / 0x%04x\n", __func__, snr_reading, *snr);