2
0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-23 12:43:55 +08:00
linux-next/drivers/media/dvb/ttpci
Dan Carpenter 9369cc96af [media] av7110: wrong limiter in av7110_start_feed()
Smatch complains that the wrong limiter is used here:
drivers/media/dvb/ttpci/av7110.c +906 dvb_feed_start_pid(12)
	error: buffer overflow 'npids' 5 <= 19

Here is the problem code:
   905          i = dvbdmxfeed->pes_type;
   906          npids[i] = (pid[i]&0x8000) ? 0 : pid[i];

"npids" is a 5 element array declared on the stack.  If
dvbdmxfeed->pes_type is more than 4 we probably put a (u16)0 past
the end of the array.

If dvbdmxfeed->pes_type is over 4 the rest of the function doesn't
do anything.  dvbdmxfeed->pes_type is capped at less than
DMX_TS_PES_OTHER (20) in the caller function, but I changed it to
less than or equal to DMX_TS_PES_PCR (4).

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Oliver Endriss <o.endriss@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
2011-11-24 14:26:02 -02:00
..
av7110_av.c Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6 2010-10-28 09:35:11 -07:00
av7110_av.h V4L/DVB (6497): saa7146/budget*/dvb-ttpci: Remove V4L1 code 2008-01-25 19:01:52 -02:00
av7110_ca.c [media] [v3,media] av7110: check for negative array offset 2011-01-19 11:45:54 -02:00
av7110_ca.h
av7110_hw.c Update broken web addresses in the kernel. 2010-10-18 11:03:14 +02:00
av7110_hw.h firmware: convert av7110 driver to request_firmware() 2009-04-06 14:34:12 -07:00
av7110_ipack.c
av7110_ipack.h
av7110_ir.c llseek: automatically add .llseek fop 2010-10-15 15:53:27 +02:00
av7110_v4l.c [media] saa7146: Use current logging styles 2011-09-03 20:54:14 -03:00
av7110.c [media] av7110: wrong limiter in av7110_start_feed() 2011-11-24 14:26:02 -02:00
av7110.h V4L/DVB (8889): dvb-ttpci: Support full-ts hardware modification 2008-10-12 09:36:56 -02:00
budget-av.c [media] stb0899: Removed an extra byte sent at init on DiSEqC bus 2011-09-25 08:41:23 -03:00
budget-ci.c [media] stb0899: Removed an extra byte sent at init on DiSEqC bus 2011-09-25 08:41:23 -03:00
budget-core.c [media] Add support for new revision of KNC 1 DVB-C cards. Using tda10024 instead of tda10023, which is compatible to tda10023 driver 2011-08-27 10:41:46 -03:00
budget-patch.c Fix common misspellings 2011-03-31 11:26:23 -03:00
budget.c Update broken web addresses in the kernel. 2010-10-18 11:03:14 +02:00
budget.h [media] Add support for new revision of KNC 1 DVB-C cards. Using tda10024 instead of tda10023, which is compatible to tda10023 driver 2011-08-27 10:41:46 -03:00
Kconfig [media] budget-ci: Add support for TT S-1500 with BSBE1-D01A tuner 2011-05-20 09:28:30 -03:00
Makefile [media] drivers/media: do not use EXTRA_CFLAGS 2011-09-03 18:50:59 -03:00
ttpci-eeprom.c [media] dvb: Add support for pctv452e 2011-09-24 00:07:42 -03:00
ttpci-eeprom.h [media] dvb: Add support for pctv452e 2011-09-24 00:07:42 -03:00