diff options
| author | Ole Ernst <olebowle@gmx.com> | 2014-03-05 14:08:15 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <m.chehab@samsung.com> | 2014-03-12 10:21:09 -0300 |
| commit | 0123f29caf65d0adef9f37f439a85d5c2822334e (patch) | |
| tree | b80ebf82bd8d405edf8a2fb61a8e98e8b021f08e /drivers/media/dvb-core | |
| parent | 2f9dff3f39f0d6dac9209e2267517aebc1c6f86c (diff) | |
| download | linux-0123f29caf65d0adef9f37f439a85d5c2822334e.tar.gz linux-0123f29caf65d0adef9f37f439a85d5c2822334e.tar.bz2 linux-0123f29caf65d0adef9f37f439a85d5c2822334e.zip | |
[media] dvb_frontend: Fix possible read out of bounds
Check if index is within bounds _before_ accessing the value.
Signed-off-by: Ole Ernst <olebowle@gmx.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Diffstat (limited to 'drivers/media/dvb-core')
| -rw-r--r-- | drivers/media/dvb-core/dvb_frontend.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c index 2d32c13ade7b..6ce435ac866f 100644 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -1279,7 +1279,7 @@ static int dtv_property_process_get(struct dvb_frontend *fe, switch(tvp->cmd) { case DTV_ENUM_DELSYS: ncaps = 0; - while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) { + while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) { tvp->u.buffer.data[ncaps] = fe->ops.delsys[ncaps]; ncaps++; } @@ -1596,7 +1596,7 @@ static int dvbv5_set_delivery_system(struct dvb_frontend *fe, * supported */ ncaps = 0; - while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) { + while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) { if (fe->ops.delsys[ncaps] == desired_system) { c->delivery_system = desired_system; dev_dbg(fe->dvb->device, @@ -1628,7 +1628,7 @@ static int dvbv5_set_delivery_system(struct dvb_frontend *fe, * of the desired system */ ncaps = 0; - while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) { + while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) { if (dvbv3_type(fe->ops.delsys[ncaps]) == type) delsys = fe->ops.delsys[ncaps]; ncaps++; @@ -1703,7 +1703,7 @@ static int dvbv3_set_delivery_system(struct dvb_frontend *fe) * DVBv3 standard */ ncaps = 0; - while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) { + while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) { if (dvbv3_type(fe->ops.delsys[ncaps]) != DVBV3_UNKNOWN) { delsys = fe->ops.delsys[ncaps]; break; |