github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-07 14:04:54 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

media: m88rs6000t: avoid potential out-of-bounds reads on arrays

Browse Source 
[ Upstream commit 9baa3d64e8 ]

There a 3 array for-loops that don't check the upper bounds of the
index into arrays and this may lead to potential out-of-bounds
reads.  Fix this by adding array size upper bounds checks to be
full safe.

Addresses-Coverity: ("Out-of-bounds read")

Link: https://lore.kernel.org/linux-media/20201007121628.20676-1-colin.king@canonical.com
Fixes: 333829110f ("[media] m88rs6000t: add new dvb-s/s2 tuner for integrated chip M88RS6000")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Colin Ian King 2020-10-07 14:16:28 +02:00 committed by Greg Kroah-Hartman
parent 96498fbb7b
commit 1f743e8d58
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/media/tuners/m88rs6000t.c
View File

@ -525,7 +525,7 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength)
PGA2_cri = PGA2_GC >> 2; PGA2_cri = PGA2_GC >> 2;
PGA2_crf = PGA2_GC & 0x03; PGA2_crf = PGA2_GC & 0x03;
for (i = 0; i <= RF_GC; i++) for (i = 0; i <= RF_GC && i < ARRAY_SIZE(RFGS); i++)
RFG += RFGS[i]; RFG += RFGS[i];
if (RF_GC == 0) if (RF_GC == 0)
@ -537,12 +537,12 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength)
if (RF_GC == 3) if (RF_GC == 3)
RFG += 100; RFG += 100;
for (i = 0; i <= IF_GC; i++) for (i = 0; i <= IF_GC && i < ARRAY_SIZE(IFGS); i++)
IFG += IFGS[i]; IFG += IFGS[i];
TIAG = TIA_GC * TIA_GS; TIAG = TIA_GC * TIA_GS;
for (i = 0; i <= BB_GC; i++) for (i = 0; i <= BB_GC && i < ARRAY_SIZE(BBGS); i++)
BBG += BBGS[i]; BBG += BBGS[i];
PGA2G = PGA2_cri * PGA2_cri_GS + PGA2_crf * PGA2_crf_GS; PGA2G = PGA2_cri * PGA2_cri_GS + PGA2_crf * PGA2_crf_GS;