From: Trent Piepho Date: Mon, 7 Aug 2006 22:43:21 +0000 (-0300) Subject: V4L/DVB (4488): Fix possible crash in Hauppauge eeprom reading X-Git-Tag: v2.6.19-rc1~643^2~84 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=18795eb98d117dbb96fadfc17a7da44c93857fd6;p=linux-2.6 V4L/DVB (4488): Fix possible crash in Hauppauge eeprom reading If an eeprom defined two tuners and they supported more than eight standards combined (as opposed to each), it would overflow an array. Signed-off-by: Trent Piepho Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c index d95529e8e5..cd1502ac95 100644 --- a/drivers/media/video/tveeprom.c +++ b/drivers/media/video/tveeprom.c @@ -605,6 +605,8 @@ void tveeprom_hauppauge_analog(struct i2c_client *c, struct tveeprom *tvee, tvee->tuner_formats |= hauppauge_tuner_fmt[i].id; t_fmt_name1[j++] = hauppauge_tuner_fmt[i].name; } + } + for (i = j = 0; i < 8; i++) { if (t_format2 & (1 << i)) { tvee->tuner2_formats |= hauppauge_tuner_fmt[i].id; t_fmt_name2[j++] = hauppauge_tuner_fmt[i].name;