If the tvp->cmd == DTV_MAX_COMMAND then we read past the end of the
array.
Signed-off-by: Dan Carpenter <error27@xxxxxxxxx>
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 9827804..607e293 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -981,7 +981,7 @@ static void dtv_property_dump(struct dtv_property *tvp)
{
int i;
- if (tvp->cmd <= 0 || tvp->cmd > DTV_MAX_COMMAND) {
+ if (tvp->cmd <= 0 || tvp->cmd >= DTV_MAX_COMMAND) {
printk(KERN_WARNING "%s: tvp.cmd = 0x%08x undefined\n",
__func__, tvp->cmd);
return;
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
