diff options
| author | Hans-Frieder Vogt <hfvogt@gmx.net> | 2012-10-03 05:25:40 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2012-10-05 14:25:11 -0300 |
| commit | 182b967e1119d22889e334c8f1c1b75df41f9165 (patch) | |
| tree | 5ebbea774a5ff5f13ddaa534c06a128baf189932 /drivers/media/dvb-frontends/af9033.c | |
| parent | 8b6faacd759933841c531c662c7eaa3046676fcc (diff) | |
| download | linux-182b967e1119d22889e334c8f1c1b75df41f9165.tar.gz linux-182b967e1119d22889e334c8f1c1b75df41f9165.tar.bz2 linux-182b967e1119d22889e334c8f1c1b75df41f9165.zip | |
[media] af9033: prevent unintended underflow
As spotted by Dan Carpenter <dan.carpenter@oracle.com> (thanks!), we have
improperly used an unsigned variable in a calculation that may result in a
negative number. This may cause an unintended underflow if the interface
frequency of the tuner is > approx. 40MHz.
This patch should resolve the issue, following an approach similar to what is
used in af9013.c.
[crope@iki.fi: add Reported-by]
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans-Frieder Vogt <hfvogt@gmx.net>
Reviewed-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media/dvb-frontends/af9033.c')
| -rw-r--r-- | drivers/media/dvb-frontends/af9033.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/drivers/media/dvb-frontends/af9033.c b/drivers/media/dvb-frontends/af9033.c index 8162d939c4b2..464ad878490b 100644 --- a/drivers/media/dvb-frontends/af9033.c +++ b/drivers/media/dvb-frontends/af9033.c @@ -408,7 +408,7 @@ static int af9033_set_frontend(struct dvb_frontend *fe) { struct af9033_state *state = fe->demodulator_priv; struct dtv_frontend_properties *c = &fe->dtv_property_cache; - int ret, i, spec_inv; + int ret, i, spec_inv, sampling_freq; u8 tmp, buf[3], bandwidth_reg_val; u32 if_frequency, freq_cw, adc_freq; @@ -465,18 +465,20 @@ static int af9033_set_frontend(struct dvb_frontend *fe) else if_frequency = 0; - while (if_frequency > (adc_freq / 2)) - if_frequency -= adc_freq; + sampling_freq = if_frequency; - if (if_frequency >= 0) + while (sampling_freq > (adc_freq / 2)) + sampling_freq -= adc_freq; + + if (sampling_freq >= 0) spec_inv *= -1; else - if_frequency *= -1; + sampling_freq *= -1; - freq_cw = af9033_div(state, if_frequency, adc_freq, 23ul); + freq_cw = af9033_div(state, sampling_freq, adc_freq, 23ul); if (spec_inv == -1) - freq_cw *= -1; + freq_cw = 0x800000 - freq_cw; /* get adc multiplies */ ret = af9033_rd_reg(state, 0x800045, &tmp); |