From a3e4adf274f86b2363fedaa964297cb38526cef0 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 26 May 2011 05:44:52 -0300 Subject: [PATCH] [media] DVB: dvb_frontend: off by one in dtv_property_dump() If the tvp->cmd == DTV_MAX_COMMAND then we read past the end of the array. Signed-off-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab --- drivers/media/dvb/dvb-core/dvb_frontend.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c index bed7bfe2a9d1..c9c3c7902d4c 100644 --- a/drivers/media/dvb/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb/dvb-core/dvb_frontend.c @@ -982,7 +982,7 @@ static void dtv_property_dump(struct dtv_property *tvp) { int i; - if (tvp->cmd <= 0 || tvp->cmd > DTV_MAX_COMMAND) { + if (tvp->cmd <= 0 || tvp->cmd >= DTV_MAX_COMMAND) { printk(KERN_WARNING "%s: tvp.cmd = 0x%08x undefined\n", __func__, tvp->cmd); return; -- 2.39.5