Linux-Media Archive on lore.kernel.org
 help / Atom feed
* [bug report] [media] dib8000: potential off by one
@ 2019-02-12 12:48 Dan Carpenter
  0 siblings, 0 replies; 1+ messages in thread
From: Dan Carpenter @ 2019-02-12 12:48 UTC (permalink / raw)
  To: pboettcher; +Cc: linux-media

Hello Patrick Boettcher,

The patch 173a64cb3fcf: "[media] dib8000: enhancement" from Apr 22,
2013, leads to the following static checker warning:

	drivers/media/dvb-frontends/dib8000.c:2132 dib8000_get_init_prbs()
	error: buffer overflow 'lut_prbs_2k' 14 <= 14

drivers/media/dvb-frontends/dib8000.c
    2123 static u16 dib8000_get_init_prbs(struct dib8000_state *state, u16 subchannel)
    2124 {
    2125 	int sub_channel_prbs_group = 0;
    2126 
    2127 	sub_channel_prbs_group = (subchannel / 3) + 1;
    2128 	dprintk("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n", sub_channel_prbs_group, subchannel, lut_prbs_8k[sub_channel_prbs_group]);
    2129 
    2130 	switch (state->fe[0]->dtv_property_cache.transmission_mode) {
    2131 	case TRANSMISSION_MODE_2K:
--> 2132 			return lut_prbs_2k[sub_channel_prbs_group];
    2133 	case TRANSMISSION_MODE_4K:
    2134 			return lut_prbs_4k[sub_channel_prbs_group];
    2135 	default:
    2136 	case TRANSMISSION_MODE_8K:
    2137 			return lut_prbs_8k[sub_channel_prbs_group];
    2138 	}
    2139 }

[ snip ]

  3305                  break;
  3306  
  3307          case CT_DEMOD_STEP_11:  /* 41 : init prbs autosearch */
  3308                  if (state->subchannel <= 41) {
                            ^^^^^^^^^^^^^^^^^^^^^^^
The problem is here.  If ->subchannel is 41 then we are off by one.
In the original code this was something like state->subchannel % 41 so
I suspect the fix is to change <= to just < but I'm not totally sure.

  3309                          dib8000_set_subchannel_prbs(state, dib8000_get_init_prbs(state, state->subchannel));
  3310                          *tune_state = CT_DEMOD_STEP_9;
  3311                  } else {
  3312                          *tune_state = CT_DEMOD_STOP;
  3313                          state->status = FE_STATUS_TUNE_FAILED;
  3314                  }
  3315                  break;
  3316  
  3317          default:
  3318                  break;
  3319          }

regards,
dan carpenter

^ permalink raw reply	[flat|nested] 1+ messages in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-02-12 12:48 [bug report] [media] dib8000: potential off by one Dan Carpenter

Linux-Media Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-media/0 linux-media/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-media linux-media/ https://lore.kernel.org/linux-media \
		linux-media@vger.kernel.org linux-media@archiver.kernel.org
	public-inbox-index linux-media


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-media


AGPL code for this site: git clone https://public-inbox.org/ public-inbox