mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-28 14:44:10 +08:00
d5872e93fa
The use of state->CH_Ctrl[i].size in a shift operation implies that its
value can be as much as 32, but the state->CH_Ctrl[i].val array is only
25 in size. Bounds check the size before shifting and looping. Fixes
warnings seen with GCC 13:
../drivers/media/tuners/mxl5005s.c: In function 'MXL_ControlWrite_Group.isra':
../drivers/media/tuners/mxl5005s.c:3450:70: warning: array subscript 32 is above array bounds of 'u16[25]' {aka 'short unsigned int[25]'} [-Warray-bounds=]
3450 | state->CH_Ctrl[i].val[j] = (u8)((value >> j) & 0x01);
| ~~~~~~~~~~~~~~~~~~~~~^~~
../drivers/media/tuners/mxl5005s.c:238:13: note: while referencing 'val'
238 | u16 val[25]; /* Binary representation of Value */
| ^~~
Cc: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
|
||
|---|---|---|
| .. | ||
| e4000_priv.h | ||
| e4000.c | ||
| e4000.h | ||
| fc001x-common.h | ||
| fc0011.c | ||
| fc0011.h | ||
| fc0012-priv.h | ||
| fc0012.c | ||
| fc0012.h | ||
| fc0013-priv.h | ||
| fc0013.c | ||
| fc0013.h | ||
| fc2580_priv.h | ||
| fc2580.c | ||
| fc2580.h | ||
| it913x.c | ||
| it913x.h | ||
| Kconfig | ||
| m88rs6000t.c | ||
| m88rs6000t.h | ||
| Makefile | ||
| max2165_priv.h | ||
| max2165.c | ||
| max2165.h | ||
| mc44s803_priv.h | ||
| mc44s803.c | ||
| mc44s803.h | ||
| msi001.c | ||
| mt20xx.c | ||
| mt20xx.h | ||
| mt2060_priv.h | ||
| mt2060.c | ||
| mt2060.h | ||
| mt2063.c | ||
| mt2063.h | ||
| mt2131_priv.h | ||
| mt2131.c | ||
| mt2131.h | ||
| mt2266.c | ||
| mt2266.h | ||
| mxl301rf.c | ||
| mxl301rf.h | ||
| mxl5005s.c | ||
| mxl5005s.h | ||
| mxl5007t.c | ||
| mxl5007t.h | ||
| qm1d1b0004.c | ||
| qm1d1b0004.h | ||
| qm1d1c0042.c | ||
| qm1d1c0042.h | ||
| qt1010_priv.h | ||
| qt1010.c | ||
| qt1010.h | ||
| r820t.c | ||
| r820t.h | ||
| si2157_priv.h | ||
| si2157.c | ||
| si2157.h | ||
| tda827x.c | ||
| tda827x.h | ||
| tda8290.c | ||
| tda8290.h | ||
| tda9887.c | ||
| tda9887.h | ||
| tda18212.c | ||
| tda18212.h | ||
| tda18218_priv.h | ||
| tda18218.c | ||
| tda18218.h | ||
| tda18250_priv.h | ||
| tda18250.c | ||
| tda18250.h | ||
| tda18271-common.c | ||
| tda18271-fe.c | ||
| tda18271-maps.c | ||
| tda18271-priv.h | ||
| tda18271.h | ||
| tea5761.c | ||
| tea5761.h | ||
| tea5767.c | ||
| tea5767.h | ||
| tua9001_priv.h | ||
| tua9001.c | ||
| tua9001.h | ||
| tuner-i2c.h | ||
| tuner-simple.c | ||
| tuner-simple.h | ||
| tuner-types.c | ||
| xc2028-types.h | ||
| xc2028.c | ||
| xc2028.h | ||
| xc4000.c | ||
| xc4000.h | ||
| xc5000.c | ||
| xc5000.h | ||