diff options
| author | Trent Piepho <xyzzy@speakeasy.org> | 2006-08-07 19:43:21 -0300 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@infradead.org> | 2006-09-26 12:30:31 -0300 |
| commit | 18795eb98d117dbb96fadfc17a7da44c93857fd6 (patch) | |
| tree | ca4a4209c302bac8d16d30f6eee85523db3a0c8e | |
| parent | 40346b290fcbf95d17c05ffe5101a1b5de8af548 (diff) | |
V4L/DVB (4488): Fix possible crash in Hauppauge eeprom reading
If an eeprom defined two tuners and they supported more than eight
standards combined (as opposed to each), it would overflow an array.
Signed-off-by: Trent Piepho <xyzzy@speakeasy.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
| -rw-r--r-- | drivers/media/video/tveeprom.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c index d95529e8e51..cd1502ac956 100644 --- a/drivers/media/video/tveeprom.c +++ b/drivers/media/video/tveeprom.c @@ -605,6 +605,8 @@ void tveeprom_hauppauge_analog(struct i2c_client *c, struct tveeprom *tvee, tvee->tuner_formats |= hauppauge_tuner_fmt[i].id; t_fmt_name1[j++] = hauppauge_tuner_fmt[i].name; } + } + for (i = j = 0; i < 8; i++) { if (t_format2 & (1 << i)) { tvee->tuner2_formats |= hauppauge_tuner_fmt[i].id; t_fmt_name2[j++] = hauppauge_tuner_fmt[i].name; |