[media] vivid-radio-rx: Don't go past buffer
authorMauro Carvalho Chehab <mchehab@osg.samsung.com>
Tue, 28 Apr 2015 23:00:55 +0000 (20:00 -0300)
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>
Thu, 30 Apr 2015 17:28:58 +0000 (14:28 -0300)
drivers/media/platform/vivid/vivid-radio-rx.c:198 vivid_radio_rx_s_hw_freq_seek() error: buffer overflow 'vivid_radio_bands' 3 <= 3

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/platform/vivid/vivid-radio-rx.c

index c7651a5..f99092c 100644 (file)
@@ -195,6 +195,8 @@ int vivid_radio_rx_s_hw_freq_seek(struct file *file, void *fh, const struct v4l2
                        if (dev->radio_rx_freq >= vivid_radio_bands[band].rangelow &&
                            dev->radio_rx_freq <= vivid_radio_bands[band].rangehigh)
                                break;
+               if (band == TOT_BANDS)
+                       return -EINVAL;
                low = vivid_radio_bands[band].rangelow;
                high = vivid_radio_bands[band].rangehigh;
        }