All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 01/27] qt1010: avoid going past array
@ 2015-04-29 23:05 Mauro Carvalho Chehab
  2015-04-29 23:05 ` [PATCH 02/27] mantis: remove dead code Mauro Carvalho Chehab
                   ` (25 more replies)
  0 siblings, 26 replies; 31+ messages in thread
From: Mauro Carvalho Chehab @ 2015-04-29 23:05 UTC (permalink / raw)
  To: Linux Media Mailing List
  Cc: Mauro Carvalho Chehab, Mauro Carvalho Chehab, Antti Palosaari

As reported by smatch:
	drivers/media/tuners/qt1010.c:357 qt1010_init() error: buffer overflow 'i2c_data' 34 <= 34

This should not happen with the current code, as the i2c_data array
doesn't end with a QT1010_M1, but it doesn't hurt add a BUG_ON
to notify if one modifies it and breaks.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/tuners/qt1010.c b/drivers/media/tuners/qt1010.c
index 74b6b17cdbaf..ae8cbece6d2b 100644
--- a/drivers/media/tuners/qt1010.c
+++ b/drivers/media/tuners/qt1010.c
@@ -354,13 +354,17 @@ static int qt1010_init(struct dvb_frontend *fe)
 				valptr = &priv->reg1f_init_val;
 			else
 				valptr = &tmpval;
+
+			BUG_ON(i >= ARRAY_SIZE(i2c_data) - 1);
+
 			err = qt1010_init_meas1(priv, i2c_data[i+1].reg,
 						i2c_data[i].reg,
 						i2c_data[i].val, valptr);
 			i++;
 			break;
 		}
-		if (err) return err;
+		if (err)
+			return err;
 	}
 
 	for (i = 0x31; i < 0x3a; i++) /* 0x31 - 0x39 */
-- 
2.1.0


^ permalink raw reply related	[flat|nested] 31+ messages in thread

end of thread, other threads:[~2015-04-30 16:57 UTC | newest]

Thread overview: 31+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-04-29 23:05 [PATCH 01/27] qt1010: avoid going past array Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 02/27] mantis: remove dead code Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 03/27] tda1004x: fix identation Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 04/27] r820t: fix identing Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 05/27] bttv: fix indenting Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 06/27] zl10353: " Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 07/27] stv0297: change typecast to u64 to avoid smatch warnings Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 08/27] ov7670: check read error also for REG_AECHH on ov7670_s_exp() Mauro Carvalho Chehab
2015-04-30 16:59   ` Jonathan Corbet
2015-04-29 23:05 ` [PATCH 09/27] cx231xx: fix bad indenting Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 10/27] dib3000mc: " Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 11/27] dib0070: Fix indenting Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 12/27] go7007: Comment some dead code Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 13/27] vp702x: comment " Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 14/27] redrat3: change return argument on redrat3_send_cmd() to int Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 15/27] sonixj: fix bad indenting Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 16/27] stk014: " Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 17/27] pvrusb2: fix inconsistent indenting Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 18/27] cx25840: fix bad identing Mauro Carvalho Chehab
2015-04-30 10:17   ` Lad, Prabhakar
2015-04-29 23:06 ` [PATCH 19/27] stv0900: fix bad indenting Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 20/27] s5h1420: use only one statement per line Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 21/27] tda10086: change typecast to u64 to avoid smatch warnings Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 22/27] bttv: fix audio hooks Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 23/27] ttusb-dec: fix bad indentation Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 24/27] s5p-mfc: " Mauro Carvalho Chehab
2015-04-29 23:06   ` Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 25/27] usbvision: " Mauro Carvalho Chehab
2015-04-30  6:19   ` Hans Verkuil
2015-04-29 23:06 ` [PATCH 26/27] saa7134: fix bad indenting Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 27/27] dib0700: fix bad indentation Mauro Carvalho Chehab

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.