[media] stb0899: don't go past DiSEqC msg buffer
authorMauro Carvalho Chehab <mchehab@osg.samsung.com>
Wed, 5 Nov 2014 11:34:12 +0000 (09:34 -0200)
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>
Wed, 5 Nov 2014 11:34:12 +0000 (09:34 -0200)
As reported by spatch:
drivers/media/dvb-frontends/stb0899_drv.c:720 stb0899_send_diseqc_msg() error: buffer overflow 'cmd->msg' 6 <= 7

The buffer size is 6 and not 8. Anyway, the best is to use sizeof(),
to avoid such mistakes.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
drivers/media/dvb-frontends/stb0899_drv.c

index 07cd5ea..19646fb 100644 (file)
@@ -705,7 +705,7 @@ static int stb0899_send_diseqc_msg(struct dvb_frontend *fe, struct dvb_diseqc_ma
        struct stb0899_state *state = fe->demodulator_priv;
        u8 reg, i;
 
-       if (cmd->msg_len > 8)
+       if (cmd->msg_len > sizeof(cmd->msg))
                return -EINVAL;
 
        /* enable FIFO precharge        */