From 0123f29caf65d0adef9f37f439a85d5c2822334e Mon Sep 17 00:00:00 2001 From: Ole Ernst Date: Wed, 5 Mar 2014 14:08:15 -0300 Subject: [PATCH] [media] dvb_frontend: Fix possible read out of bounds Check if index is within bounds _before_ accessing the value. Signed-off-by: Ole Ernst Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb-core/dvb_frontend.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c index 2d32c13ade7b..6ce435ac866f 100644 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -1279,7 +1279,7 @@ static int dtv_property_process_get(struct dvb_frontend *fe, switch(tvp->cmd) { case DTV_ENUM_DELSYS: ncaps = 0; - while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) { + while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) { tvp->u.buffer.data[ncaps] = fe->ops.delsys[ncaps]; ncaps++; } @@ -1596,7 +1596,7 @@ static int dvbv5_set_delivery_system(struct dvb_frontend *fe, * supported */ ncaps = 0; - while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) { + while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) { if (fe->ops.delsys[ncaps] == desired_system) { c->delivery_system = desired_system; dev_dbg(fe->dvb->device, @@ -1628,7 +1628,7 @@ static int dvbv5_set_delivery_system(struct dvb_frontend *fe, * of the desired system */ ncaps = 0; - while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) { + while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) { if (dvbv3_type(fe->ops.delsys[ncaps]) == type) delsys = fe->ops.delsys[ncaps]; ncaps++; @@ -1703,7 +1703,7 @@ static int dvbv3_set_delivery_system(struct dvb_frontend *fe) * DVBv3 standard */ ncaps = 0; - while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) { + while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) { if (dvbv3_type(fe->ops.delsys[ncaps]) != DVBV3_UNKNOWN) { delsys = fe->ops.delsys[ncaps]; break; -- 2.39.5