OSDN Git Service

[media] dvb-usb: check for invalid length in ttusb_process_muxpack()
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 7 Feb 2013 07:24:49 +0000 (04:24 -0300)
committerMauro Carvalho Chehab <mchehab@redhat.com>
Fri, 8 Feb 2013 19:29:52 +0000 (17:29 -0200)
commitbf5bbed15c41228ea1abbb8d3931050922bfc37f
tree84e9db5c9d1e57a42ccbcb7ffaaefb8d0ee1f025
parent3e58ac14ad2c443d86c5bed0137a010fe4d16fe2
[media] dvb-usb: check for invalid length in ttusb_process_muxpack()

This patch is driven by a static checker warning.
The ttusb_process_muxpack() function is only called from
ttusb_process_frame().  Before calling, it verifies that len >= 2.  The
problem is that len == 2 is not valid and would lead to an array
underflow.
Odd number values for len are also invalid and would lead to reading
past the end of the array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c