As warned by smatch:
drivers/media/dvb-frontends/lgdt3306a.c:1354 log10_x1000() error: buffer overflow 'valx_x10' 14 <= 14
drivers/media/dvb-frontends/lgdt3306a.c:1355 log10_x1000() error: buffer overflow 'log10x_x1000' 14 <= 14
There's a potential of returning a value out of the buffer. Fix it.
While here, remove the ugly braced block.
Signed-off-by: Mauro Carvalho Chehab <mchehab@xxxxxxxxxxxxxxx>
diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c
index c8af071ce40b..92affe124a8d 100644
--- a/drivers/media/dvb-frontends/lgdt3306a.c
+++ b/drivers/media/dvb-frontends/lgdt3306a.c
@@ -1319,6 +1319,7 @@ static u32 log10_x1000(u32 x)
static u32 valx_x10[] = { 10, 11, 13, 15, 17, 20, 25, 33, 41, 50, 59, 73, 87, 100 };
static u32 log10x_x1000[] = { 0, 41, 114, 176, 230, 301, 398, 518, 613, 699, 771, 863, 939, 1000 };
static u32 nelems = sizeof(valx_x10)/sizeof(valx_x10[0]);
+ u32 diff_val, step_val, step_log10;
u32 log_val = 0;
u32 i;
@@ -1348,15 +1349,16 @@ static u32 log10_x1000(u32 x)
if (valx_x10[i] >= x)
break;
}
+ if (i == nelems)
+ return log_val + log10x_x1000[i - 1];
- {
- u32 diff_val = x - valx_x10[i-1];
- u32 step_val = valx_x10[i] - valx_x10[i-1];
- u32 step_log10 = log10x_x1000[i] - log10x_x1000[i-1];
- /* do a linear interpolation to get in-between values */
- return log_val + log10x_x1000[i-1] +
- ((diff_val*step_log10) / step_val);
- }
+ diff_val = x - valx_x10[i-1];
+ step_val = valx_x10[i] - valx_x10[i - 1];
+ step_log10 = log10x_x1000[i] - log10x_x1000[i - 1];
+
+ /* do a linear interpolation to get in-between values */
+ return log_val + log10x_x1000[i - 1] +
+ ((diff_val*step_log10) / step_val);
}
static u32 lgdt3306a_calculate_snr_x100(struct lgdt3306a_state *state)
--
1.9.3
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
