Эх сурвалжийг харах

V4L/DVB (4488): Fix possible crash in Hauppauge eeprom reading

If an eeprom defined two tuners and they supported more than eight
standards combined (as opposed to each), it would overflow an array. 

Signed-off-by: Trent Piepho <xyzzy@speakeasy.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Trent Piepho 19 жил өмнө
parent
commit
18795eb98d

+ 2 - 0
drivers/media/video/tveeprom.c

@@ -605,6 +605,8 @@ void tveeprom_hauppauge_analog(struct i2c_client *c, struct tveeprom *tvee,
 			tvee->tuner_formats |= hauppauge_tuner_fmt[i].id;
 			t_fmt_name1[j++] = hauppauge_tuner_fmt[i].name;
 		}
+	}
+	for (i = j = 0; i < 8; i++) {
 		if (t_format2 & (1 << i)) {
 			tvee->tuner2_formats |= hauppauge_tuner_fmt[i].id;
 			t_fmt_name2[j++] = hauppauge_tuner_fmt[i].name;