[PATCH 1/2] Revert "[media] ivtv: avoid going past input/audio array"

[PATCH 1/2] Revert "[media] ivtv: avoid going past input/audio array"

[Mauro Carvalho Chehab]

This patch broke ivtv logic, as reported at
 https://bugzilla.redhat.com/show_bug.cgi?id=1278942

This reverts commit 09290cc885937cab3b2d60a6d48fe3d2d3e04061.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/pci/ivtv/ivtv-driver.c b/drivers/media/pci/ivtv/ivtv-driver.c
index 3a6f668b14b8..21501c560610 100644
--- a/drivers/media/pci/ivtv/ivtv-driver.c
+++ b/drivers/media/pci/ivtv/ivtv-driver.c
@@ -805,11 +805,11 @@ static void ivtv_init_struct2(struct ivtv *itv)
 {
 	int i;
 
-	for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS - 1; i++)
+	for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS; i++)
 		if (itv->card->video_inputs[i].video_type == 0)
 			break;
 	itv->nof_inputs = i;
-	for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS - 1; i++)
+	for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS; i++)
 		if (itv->card->audio_inputs[i].audio_type == 0)
 			break;
 	itv->nof_audio_inputs = i;
-- 
2.4.3

[PATCH 2/2] [media] ivtv: avoid going past input/audio array As reported by smatch: drivers/media/pci/ivtv/ivtv-driver.c:832 ivtv_init_struct2() error: buffer overflow 'itv->card->video_inputs' 6 <= 6

[Mauro Carvalho Chehab]

drivers/media/pci/ivtv/ivtv-driver.c:832 ivtv_init_struct2() error: buffer overflow 'itv->card->video_inputs' 6 <= 6

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/pci/ivtv/ivtv-driver.c b/drivers/media/pci/ivtv/ivtv-driver.c
index 21501c560610..374033a5bdaf 100644
--- a/drivers/media/pci/ivtv/ivtv-driver.c
+++ b/drivers/media/pci/ivtv/ivtv-driver.c
@@ -826,7 +826,7 @@ static void ivtv_init_struct2(struct ivtv *itv)
 				IVTV_CARD_INPUT_VID_TUNER)
 			break;
 	}
-	if (i == itv->nof_inputs)
+	if (i >= itv->nof_inputs)
 		i = 0;
 	itv->active_input = i;
 	itv->audio_input = itv->card->video_inputs[i].audio_index;
-- 
2.4.3

Re: [PATCH 1/2] Revert "[media] ivtv: avoid going past input/audio array"

[Andrew Meredith]

Hi Mauro,

There was a flurry of activity around November last year, so thanks for 
that, but nothing seems to made it through to the stock Fedora kernel.

Have I missed something, or is there a roadblock somewhere?

I ask as I haven't allowed any updates through since November last and 
they're piling up somewhat.

Andy M

On 11/11/2015 11:48 AM, Mauro Carvalho Chehab wrote:
> This patch broke ivtv logic, as reported at
>   https://bugzilla.redhat.com/show_bug.cgi?id=1278942
>
> This reverts commit 09290cc885937cab3b2d60a6d48fe3d2d3e04061.
>
> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
>
> diff --git a/drivers/media/pci/ivtv/ivtv-driver.c b/drivers/media/pci/ivtv/ivtv-driver.c
> index 3a6f668b14b8..21501c560610 100644
> --- a/drivers/media/pci/ivtv/ivtv-driver.c
> +++ b/drivers/media/pci/ivtv/ivtv-driver.c
> @@ -805,11 +805,11 @@ static void ivtv_init_struct2(struct ivtv *itv)
>   {
>   	int i;
>
> -	for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS - 1; i++)
> +	for (i = 0; i < IVTV_CARD_MAX_VIDEO_INPUTS; i++)
>   		if (itv->card->video_inputs[i].video_type == 0)
>   			break;
>   	itv->nof_inputs = i;
> -	for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS - 1; i++)
> +	for (i = 0; i < IVTV_CARD_MAX_AUDIO_INPUTS; i++)
>   		if (itv->card->audio_inputs[i].audio_type == 0)
>   			break;
>   	itv->nof_audio_inputs = i;
>


-- 
Andrew Meredith CEng CITP