Re: [git:v4l-dvb/for_v3.1] [media] DVB: dvb_frontend: off by one in dtv_property_dump()

Re: [git:v4l-dvb/for_v3.1] [media] DVB: dvb_frontend: off by one in dtv_property_dump()

[Andreas Oberritter]

On 13.07.2011 23:28, Mauro Carvalho Chehab wrote:
> This is an automatic generated email to let you know that the following patch were queued at the 
> http://git.linuxtv.org/media_tree.git tree:
> 
> Subject: [media] DVB: dvb_frontend: off by one in dtv_property_dump()
> Author:  Dan Carpenter <error27@gmail.com>
> Date:    Thu May 26 05:44:52 2011 -0300
> 
> If the tvp->cmd == DTV_MAX_COMMAND then we read past the end of the
> array.

That's wrong, because the array size is DTV_MAX_COMMAND + 1. Using the
ARRAY_SIZE macro instead might reduce the confusion.

Regards,
Andreas

> Signed-off-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
> 
>  drivers/media/dvb/dvb-core/dvb_frontend.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> ---
> 
> http://git.linuxtv.org/media_tree.git?a=commitdiff;h=a3e4adf274f86b2363fedaa964297cb38526cef0
> 
> diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
> index bed7bfe..c9c3c79 100644
> --- a/drivers/media/dvb/dvb-core/dvb_frontend.c
> +++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
> @@ -982,7 +982,7 @@ static void dtv_property_dump(struct dtv_property *tvp)
>  {
>  	int i;
>  
> -	if (tvp->cmd <= 0 || tvp->cmd > DTV_MAX_COMMAND) {
> +	if (tvp->cmd <= 0 || tvp->cmd >= DTV_MAX_COMMAND) {
>  		printk(KERN_WARNING "%s: tvp.cmd = 0x%08x undefined\n",
>  			__func__, tvp->cmd);
>  		return;
> 
> _______________________________________________
> linuxtv-commits mailing list
> linuxtv-commits@linuxtv.org
> http://www.linuxtv.org/cgi-bin/mailman/listinfo/linuxtv-commits

Re: [git:v4l-dvb/for_v3.1] [media] DVB: dvb_frontend: off by one in dtv_property_dump()

[Andreas Oberritter]

On 14.07.2011 02:25, Andreas Oberritter wrote:
> On 13.07.2011 23:28, Mauro Carvalho Chehab wrote:
>> This is an automatic generated email to let you know that the following patch were queued at the 
>> http://git.linuxtv.org/media_tree.git tree:
>>
>> Subject: [media] DVB: dvb_frontend: off by one in dtv_property_dump()
>> Author:  Dan Carpenter <error27@gmail.com>
>> Date:    Thu May 26 05:44:52 2011 -0300
>>
>> If the tvp->cmd == DTV_MAX_COMMAND then we read past the end of the
>> array.

Hi Mauro,

in case you missed my comment, here's the changeset that already fixed the
issue differently:

http://git.linuxtv.org/media_tree.git?a=commitdiff;h=3995223038d71e75def28c11d4e802f0bb7eff38

See also this thread: http://www.spinics.net/lists/linux-kernel-janitors/msg09077.html

Regards,
Andreas

Re: [git:v4l-dvb/for_v3.1] [media] DVB: dvb_frontend: off by one in dtv_property_dump()

[Mauro Carvalho Chehab]

Em 15-07-2011 07:51, Andreas Oberritter escreveu:
> On 14.07.2011 02:25, Andreas Oberritter wrote:
>> On 13.07.2011 23:28, Mauro Carvalho Chehab wrote:
>>> This is an automatic generated email to let you know that the following patch were queued at the 
>>> http://git.linuxtv.org/media_tree.git tree:
>>>
>>> Subject: [media] DVB: dvb_frontend: off by one in dtv_property_dump()
>>> Author:  Dan Carpenter <error27@gmail.com>
>>> Date:    Thu May 26 05:44:52 2011 -0300
>>>
>>> If the tvp->cmd == DTV_MAX_COMMAND then we read past the end of the
>>> array.
> 
> Hi Mauro,
> 
> in case you missed my comment, here's the changeset that already fixed the
> issue differently:
> 
> http://git.linuxtv.org/media_tree.git?a=commitdiff;h=3995223038d71e75def28c11d4e802f0bb7eff38
> 
> See also this thread: http://www.spinics.net/lists/linux-kernel-janitors/msg09077.html

Ah, thanks for remind me!

Yeah, I followed that tread and applied the right place, but hundreds of patches later,
and patchwork 'blaming' me of not committing or rejecting that patch, I ended by applying
the wrong version also. Thanks for pointing me!

I've reverted the wrong patch at the tree.

Thanks!
Mauro