From: Dan Carpenter <dan.carpenter@oracle.com>
To: pboettcher@kernellabs.com
Cc: linux-media@vger.kernel.org
Subject: [bug report] [media] dib8000: potential off by one
Date: Tue, 12 Feb 2019 15:48:47 +0300 [thread overview]
Message-ID: <20190212124847.GA11184@kadam> (raw)
Hello Patrick Boettcher,
The patch 173a64cb3fcf: "[media] dib8000: enhancement" from Apr 22,
2013, leads to the following static checker warning:
drivers/media/dvb-frontends/dib8000.c:2132 dib8000_get_init_prbs()
error: buffer overflow 'lut_prbs_2k' 14 <= 14
drivers/media/dvb-frontends/dib8000.c
2123 static u16 dib8000_get_init_prbs(struct dib8000_state *state, u16 subchannel)
2124 {
2125 int sub_channel_prbs_group = 0;
2126
2127 sub_channel_prbs_group = (subchannel / 3) + 1;
2128 dprintk("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n", sub_channel_prbs_group, subchannel, lut_prbs_8k[sub_channel_prbs_group]);
2129
2130 switch (state->fe[0]->dtv_property_cache.transmission_mode) {
2131 case TRANSMISSION_MODE_2K:
--> 2132 return lut_prbs_2k[sub_channel_prbs_group];
2133 case TRANSMISSION_MODE_4K:
2134 return lut_prbs_4k[sub_channel_prbs_group];
2135 default:
2136 case TRANSMISSION_MODE_8K:
2137 return lut_prbs_8k[sub_channel_prbs_group];
2138 }
2139 }
[ snip ]
3305 break;
3306
3307 case CT_DEMOD_STEP_11: /* 41 : init prbs autosearch */
3308 if (state->subchannel <= 41) {
^^^^^^^^^^^^^^^^^^^^^^^
The problem is here. If ->subchannel is 41 then we are off by one.
In the original code this was something like state->subchannel % 41 so
I suspect the fix is to change <= to just < but I'm not totally sure.
3309 dib8000_set_subchannel_prbs(state, dib8000_get_init_prbs(state, state->subchannel));
3310 *tune_state = CT_DEMOD_STEP_9;
3311 } else {
3312 *tune_state = CT_DEMOD_STOP;
3313 state->status = FE_STATUS_TUNE_FAILED;
3314 }
3315 break;
3316
3317 default:
3318 break;
3319 }
regards,
dan carpenter
reply other threads:[~2019-02-12 12:48 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190212124847.GA11184@kadam \
--to=dan.carpenter@oracle.com \
--cc=linux-media@vger.kernel.org \
--cc=pboettcher@kernellabs.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).