public inbox for linux-media@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH 01/27] qt1010: avoid going past array
@ 2015-04-29 23:05 Mauro Carvalho Chehab
  2015-04-29 23:05 ` [PATCH 02/27] mantis: remove dead code Mauro Carvalho Chehab
                   ` (25 more replies)
  0 siblings, 26 replies; 30+ messages in thread
From: Mauro Carvalho Chehab @ 2015-04-29 23:05 UTC (permalink / raw)
  To: Linux Media Mailing List
  Cc: Mauro Carvalho Chehab, Mauro Carvalho Chehab, Antti Palosaari

As reported by smatch:
	drivers/media/tuners/qt1010.c:357 qt1010_init() error: buffer overflow 'i2c_data' 34 <= 34

This should not happen with the current code, as the i2c_data array
doesn't end with a QT1010_M1, but it doesn't hurt add a BUG_ON
to notify if one modifies it and breaks.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

diff --git a/drivers/media/tuners/qt1010.c b/drivers/media/tuners/qt1010.c
index 74b6b17cdbaf..ae8cbece6d2b 100644
--- a/drivers/media/tuners/qt1010.c
+++ b/drivers/media/tuners/qt1010.c
@@ -354,13 +354,17 @@ static int qt1010_init(struct dvb_frontend *fe)
 				valptr = &priv->reg1f_init_val;
 			else
 				valptr = &tmpval;
+
+			BUG_ON(i >= ARRAY_SIZE(i2c_data) - 1);
+
 			err = qt1010_init_meas1(priv, i2c_data[i+1].reg,
 						i2c_data[i].reg,
 						i2c_data[i].val, valptr);
 			i++;
 			break;
 		}
-		if (err) return err;
+		if (err)
+			return err;
 	}
 
 	for (i = 0x31; i < 0x3a; i++) /* 0x31 - 0x39 */
-- 
2.1.0


^ permalink raw reply related	[flat|nested] 30+ messages in thread

end of thread, other threads:[~2015-04-30 16:57 UTC | newest]

Thread overview: 30+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-04-29 23:05 [PATCH 01/27] qt1010: avoid going past array Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 02/27] mantis: remove dead code Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 03/27] tda1004x: fix identation Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 04/27] r820t: fix identing Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 05/27] bttv: fix indenting Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 06/27] zl10353: " Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 07/27] stv0297: change typecast to u64 to avoid smatch warnings Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 08/27] ov7670: check read error also for REG_AECHH on ov7670_s_exp() Mauro Carvalho Chehab
2015-04-30 16:59   ` Jonathan Corbet
2015-04-29 23:05 ` [PATCH 09/27] cx231xx: fix bad indenting Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 10/27] dib3000mc: " Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 11/27] dib0070: Fix indenting Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 12/27] go7007: Comment some dead code Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 13/27] vp702x: comment " Mauro Carvalho Chehab
2015-04-29 23:05 ` [PATCH 14/27] redrat3: change return argument on redrat3_send_cmd() to int Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 15/27] sonixj: fix bad indenting Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 16/27] stk014: " Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 17/27] pvrusb2: fix inconsistent indenting Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 18/27] cx25840: fix bad identing Mauro Carvalho Chehab
2015-04-30 10:17   ` Lad, Prabhakar
2015-04-29 23:06 ` [PATCH 19/27] stv0900: fix bad indenting Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 20/27] s5h1420: use only one statement per line Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 21/27] tda10086: change typecast to u64 to avoid smatch warnings Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 22/27] bttv: fix audio hooks Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 23/27] ttusb-dec: fix bad indentation Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 24/27] s5p-mfc: " Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 25/27] usbvision: " Mauro Carvalho Chehab
2015-04-30  6:19   ` Hans Verkuil
2015-04-29 23:06 ` [PATCH 26/27] saa7134: fix bad indenting Mauro Carvalho Chehab
2015-04-29 23:06 ` [PATCH 27/27] dib0700: fix bad indentation Mauro Carvalho Chehab

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox