* [PATCH] media: tda18250: fix possible integer overflow
@ 2026-07-19 13:08 Ilya Krutskih
0 siblings, 0 replies; only message in thread
From: Ilya Krutskih @ 2026-07-19 13:08 UTC (permalink / raw)
To: Olli Salonen
Cc: Ilya Krutskih, lvc-patches, Mauro Carvalho Chehab, linux-media,
linux-kernel, stable
Integer overflow may occur, when variable exp equals to zero. Result
of shift 1 << (exp - 1) may then leads to undefined behavior.
Fixes: 148abd3b5b14 ("media: tda18250: support for new silicon tuner")
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Krutskih <devsec@tpz.ru>
---
drivers/media/tuners/tda18250.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/tuners/tda18250.c b/drivers/media/tuners/tda18250.c
index 8a5781b966ee..d1d97da05215 100644
--- a/drivers/media/tuners/tda18250.c
+++ b/drivers/media/tuners/tda18250.c
@@ -440,8 +440,8 @@ static int tda18250_pll_calc(struct dvb_frontend *fe, u8 *rdiv,
goto err;
exp = (uval & 0x70) >> 4;
- if (exp > 5)
- exp = 0;
+ if (exp == 0 || exp > 5)
+ exp = 1;
lopd = 1 << (exp - 1);
scale = uval & 0x0f;
fvco = lopd * scale * ((c->frequency / 1000) + dev->if_frequency);
--
2.43.0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-19 13:08 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-19 13:08 [PATCH] media: tda18250: fix possible integer overflow Ilya Krutskih
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.