Hello Patrick Boettcher,
The patch 173a64cb3fcf: "[media] dib8000: enhancement" from Apr 22,
2013, leads to the following static checker warning:
drivers/media/dvb-frontends/dib8000.c:2132 dib8000_get_init_prbs()
error: buffer overflow 'lut_prbs_2k' 14 <= 14
drivers/media/dvb-frontends/dib8000.c
2123 static u16 dib8000_get_init_prbs(struct dib8000_state *state, u16 subchannel)
2124 {
2125 int sub_channel_prbs_group = 0;
2126
2127 sub_channel_prbs_group = (subchannel / 3) + 1;
2128 dprintk("sub_channel_prbs_group = %d , subchannel =%d prbs = 0x%04x\n", sub_channel_prbs_group, subchannel, lut_prbs_8k[sub_channel_prbs_group]);
2129
2130 switch (state->fe[0]->dtv_property_cache.transmission_mode) {
2131 case TRANSMISSION_MODE_2K:
--> 2132 return lut_prbs_2k[sub_channel_prbs_group];
2133 case TRANSMISSION_MODE_4K:
2134 return lut_prbs_4k[sub_channel_prbs_group];
2135 default:
2136 case TRANSMISSION_MODE_8K:
2137 return lut_prbs_8k[sub_channel_prbs_group];
2138 }
2139 }
[ snip ]
3305 break;
3306
3307 case CT_DEMOD_STEP_11: /* 41 : init prbs autosearch */
3308 if (state->subchannel <= 41) {
^^^^^^^^^^^^^^^^^^^^^^^
The problem is here. If ->subchannel is 41 then we are off by one.
In the original code this was something like state->subchannel % 41 so
I suspect the fix is to change <= to just < but I'm not totally sure.
3309 dib8000_set_subchannel_prbs(state, dib8000_get_init_prbs(state, state->subchannel));
3310 *tune_state = CT_DEMOD_STEP_9;
3311 } else {
3312 *tune_state = CT_DEMOD_STOP;
3313 state->status = FE_STATUS_TUNE_FAILED;
3314 }
3315 break;
3316
3317 default:
3318 break;
3319 }
regards,
dan carpenter
