diff options
| author | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2015-04-29 09:33:02 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@osg.samsung.com> | 2015-04-30 14:57:35 -0300 |
| commit | 4682b58e5af01ee856a706083eac71238fb69cd0 (patch) | |
| tree | 760d763f5226452fdc0448387019bd521f6e8cc5 /drivers/media/tuners/qt1010.c | |
| parent | 322583c410b6206700f5daa98f965b31c99bb8c2 (diff) | |
[media] qt1010: avoid going past array
As reported by smatch:
drivers/media/tuners/qt1010.c:357 qt1010_init() error: buffer overflow 'i2c_data' 34 <= 34
This should not happen with the current code, as the i2c_data array
doesn't end with a QT1010_M1, but it doesn't hurt add a BUG_ON
to notify if one modifies it and breaks.
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Diffstat (limited to 'drivers/media/tuners/qt1010.c')
| -rw-r--r-- | drivers/media/tuners/qt1010.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/media/tuners/qt1010.c b/drivers/media/tuners/qt1010.c index 74b6b17cdbaf..ae8cbece6d2b 100644 --- a/drivers/media/tuners/qt1010.c +++ b/drivers/media/tuners/qt1010.c @@ -354,13 +354,17 @@ static int qt1010_init(struct dvb_frontend *fe) valptr = &priv->reg1f_init_val; else valptr = &tmpval; + + BUG_ON(i >= ARRAY_SIZE(i2c_data) - 1); + err = qt1010_init_meas1(priv, i2c_data[i+1].reg, i2c_data[i].reg, i2c_data[i].val, valptr); i++; break; } - if (err) return err; + if (err) + return err; } for (i = 0x31; i < 0x3a; i++) /* 0x31 - 0x39 */ |