forked from Minki/linux
525cac7574
In stop(), an (unlikely) out-of-bounds write error can occur when setting
the demod_in_use element indexed by state->demod to zero, as state->demod
isn't checked for being in the range of the array size of demod_in_use, and
state->demod maybe carrying the magic 0xff (demod unused) value. Prevent
this by checking state->demod not exceeding the array size before setting
the element value. To make the code a bit easier to read, replace the magic
value and the number of array elements with defines, and use them at a few
more places.
Detected by CoverityScan, CID#1468550 ("Out-of-bounds write")
Thanks to Colin for reporting the problem and providing an initial patch.
Fixes:
|
||
|---|---|---|
| .. | ||
| ddbridge-ci.c | ||
| ddbridge-ci.h | ||
| ddbridge-core.c | ||
| ddbridge-hw.c | ||
| ddbridge-hw.h | ||
| ddbridge-i2c.c | ||
| ddbridge-i2c.h | ||
| ddbridge-io.h | ||
| ddbridge-main.c | ||
| ddbridge-max.c | ||
| ddbridge-max.h | ||
| ddbridge-mci.c | ||
| ddbridge-mci.h | ||
| ddbridge-regs.h | ||
| ddbridge.h | ||
| Kconfig | ||
| Makefile | ||