Commit 18795eb9 authored Aug 07, 2006 by Trent Piepho Committed by Mauro Carvalho Chehab Sep 26, 2006

V4L/DVB (4488): Fix possible crash in Hauppauge eeprom reading

If an eeprom defined two tuners and they supported more than eight
standards combined (as opposed to each), it would overflow an array.

Signed-off-by: Trent Piepho <xyzzy@speakeasy.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

parent 40346b29

drivers/media/video/tveeprom.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -605,6 +605,8 @@ void tveeprom_hauppauge_analog(struct i2c_client c, struct tveeprom tvee,
		tvee->tuner_formats \|= hauppauge_tuner_fmt[i].id;
		t_fmt_name1[j++] = hauppauge_tuner_fmt[i].name;
		}
		}
		for (i = j = 0; i < 8; i++) {
		if (t_format2 & (1 << i)) {
		tvee->tuner2_formats \|= hauppauge_tuner_fmt[i].id;
		t_fmt_name2[j++] = hauppauge_tuner_fmt[i].name;