| From 4765fb67747a4346937379e55f73967e123340bd Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 7 Oct 2020 14:16:28 +0200 |
| Subject: media: m88rs6000t: avoid potential out-of-bounds reads on arrays |
| |
| From: Colin Ian King <colin.king@canonical.com> |
| |
| [ Upstream commit 9baa3d64e8e2373ddd11c346439e5dfccb2cbb0d ] |
| |
| There a 3 array for-loops that don't check the upper bounds of the |
| index into arrays and this may lead to potential out-of-bounds |
| reads. Fix this by adding array size upper bounds checks to be |
| full safe. |
| |
| Addresses-Coverity: ("Out-of-bounds read") |
| |
| Link: https://lore.kernel.org/linux-media/20201007121628.20676-1-colin.king@canonical.com |
| Fixes: 333829110f1d ("[media] m88rs6000t: add new dvb-s/s2 tuner for integrated chip M88RS6000") |
| Signed-off-by: Colin Ian King <colin.king@canonical.com> |
| Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/media/tuners/m88rs6000t.c | 6 +++--- |
| 1 file changed, 3 insertions(+), 3 deletions(-) |
| |
| diff --git a/drivers/media/tuners/m88rs6000t.c b/drivers/media/tuners/m88rs6000t.c |
| index b3505f402476..8647c50b66e5 100644 |
| --- a/drivers/media/tuners/m88rs6000t.c |
| +++ b/drivers/media/tuners/m88rs6000t.c |
| @@ -525,7 +525,7 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength) |
| PGA2_cri = PGA2_GC >> 2; |
| PGA2_crf = PGA2_GC & 0x03; |
| |
| - for (i = 0; i <= RF_GC; i++) |
| + for (i = 0; i <= RF_GC && i < ARRAY_SIZE(RFGS); i++) |
| RFG += RFGS[i]; |
| |
| if (RF_GC == 0) |
| @@ -537,12 +537,12 @@ static int m88rs6000t_get_rf_strength(struct dvb_frontend *fe, u16 *strength) |
| if (RF_GC == 3) |
| RFG += 100; |
| |
| - for (i = 0; i <= IF_GC; i++) |
| + for (i = 0; i <= IF_GC && i < ARRAY_SIZE(IFGS); i++) |
| IFG += IFGS[i]; |
| |
| TIAG = TIA_GC * TIA_GS; |
| |
| - for (i = 0; i <= BB_GC; i++) |
| + for (i = 0; i <= BB_GC && i < ARRAY_SIZE(BBGS); i++) |
| BBG += BBGS[i]; |
| |
| PGA2G = PGA2_cri * PGA2_cri_GS + PGA2_crf * PGA2_crf_GS; |
| -- |
| 2.30.2 |
| |
