From: Dan Carpenter <dan.carpenter@oracle.com>
To: Mauro Carvalho Chehab <mchehab@redhat.com>,
Michael Hunold <michael@mihu.de>
Cc: Jonathan Nieder <jrnieder@gmail.com>,
linux-media@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [media] dvb-usb: reading before start of array
Date: Wed, 09 Jan 2013 07:36:32 +0000 [thread overview]
Message-ID: <20130109073632.GD2454@elgon.mountain> (raw)
This is a static checker fix. In the ttusb_process_muxpack() we do:
cc = (muxpack[len - 4] << 8) | muxpack[len - 3];
That means if we pass a number less than 4 then we will either trigger a
checksum error message or read before the start of the array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
I can't test this.
This patch doesn't introduce any bugs, but I'm not positive this is the
right thing to do. Perhaps it's better to print an error message?
diff --git a/drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c b/drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c
index 5b682cc..99a2fd1 100644
--- a/drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c
+++ b/drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c
@@ -709,7 +709,7 @@ static void ttusb_process_frame(struct ttusb *ttusb, u8 * data, int len)
* if length is valid and we reached the end:
* goto next muxpack
*/
- if ((ttusb->muxpack_ptr >= 2) &&
+ if ((ttusb->muxpack_ptr >= 4) &&
(ttusb->muxpack_ptr =
ttusb->muxpack_len)) {
ttusb_process_muxpack(ttusb,
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Mauro Carvalho Chehab <mchehab@redhat.com>,
Michael Hunold <michael@mihu.de>
Cc: Jonathan Nieder <jrnieder@gmail.com>,
linux-media@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [media] dvb-usb: reading before start of array
Date: Wed, 9 Jan 2013 10:36:32 +0300 [thread overview]
Message-ID: <20130109073632.GD2454@elgon.mountain> (raw)
This is a static checker fix. In the ttusb_process_muxpack() we do:
cc = (muxpack[len - 4] << 8) | muxpack[len - 3];
That means if we pass a number less than 4 then we will either trigger a
checksum error message or read before the start of the array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
I can't test this.
This patch doesn't introduce any bugs, but I'm not positive this is the
right thing to do. Perhaps it's better to print an error message?
diff --git a/drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c b/drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c
index 5b682cc..99a2fd1 100644
--- a/drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c
+++ b/drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c
@@ -709,7 +709,7 @@ static void ttusb_process_frame(struct ttusb *ttusb, u8 * data, int len)
* if length is valid and we reached the end:
* goto next muxpack
*/
- if ((ttusb->muxpack_ptr >= 2) &&
+ if ((ttusb->muxpack_ptr >= 4) &&
(ttusb->muxpack_ptr ==
ttusb->muxpack_len)) {
ttusb_process_muxpack(ttusb,
next reply other threads:[~2013-01-09 7:36 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-01-09 7:36 Dan Carpenter [this message]
2013-01-09 7:36 ` [media] dvb-usb: reading before start of array Dan Carpenter
2013-02-05 22:10 ` Mauro Carvalho Chehab
2013-02-05 22:10 ` Mauro Carvalho Chehab
2013-02-07 8:24 ` [patch v2] dvb-usb: check for invalid length in ttusb_process_muxpack() Dan Carpenter
2013-02-07 8:24 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130109073632.GD2454@elgon.mountain \
--to=dan.carpenter@oracle.com \
--cc=jrnieder@gmail.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@redhat.com \
--cc=michael@mihu.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.