As reported by Dan Carpenter <dan.carpenter@xxxxxxxxxx>
FYI, there are new smatch warnings show up in:
tree: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next master
head: da17d7bda957ae4697b6abc0793f74fb9b50b58f
commit: 04fa725e7b1c22c583dd71a8cd85b8d997edfce3 [media] mb86a20s: Implement set_frontend cache logic
New smatch warnings:
drivers/media/dvb-frontends/mb86a20s.c:1897 mb86a20s_set_frontend() error: buffer overflow 'mb86a20s_subchannel' 8 <= 8
04fa725e Mauro Carvalho Chehab 2013-03-04 1894 if (c->isdbt_sb_subchannel > ARRAY_SIZE(mb86a20s_subchannel))
04fa725e Mauro Carvalho Chehab 2013-03-04 1895 c->isdbt_sb_subchannel = 0;
04fa725e Mauro Carvalho Chehab 2013-03-04 1896
04fa725e Mauro Carvalho Chehab 2013-03-04 @1897 state->subchannel = mb86a20s_subchannel[c->isdbt_sb_subchannel];
Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxx>
---
drivers/media/dvb-frontends/mb86a20s.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/dvb-frontends/mb86a20s.c b/drivers/media/dvb-frontends/mb86a20s.c
index 6ff1375..2666ff4 100644
--- a/drivers/media/dvb-frontends/mb86a20s.c
+++ b/drivers/media/dvb-frontends/mb86a20s.c
@@ -1915,7 +1915,7 @@ static int mb86a20s_set_frontend(struct dvb_frontend *fe)
if (!c->isdbt_sb_mode) {
state->subchannel = 0;
} else {
- if (c->isdbt_sb_subchannel > ARRAY_SIZE(mb86a20s_subchannel))
+ if (c->isdbt_sb_subchannel >= ARRAY_SIZE(mb86a20s_subchannel))
c->isdbt_sb_subchannel = 0;
state->subchannel = mb86a20s_subchannel[c->isdbt_sb_subchannel];
--
1.8.1.4
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
