diff options
| author | Douglas Schilling Landgraf <dougsland@redhat.com> | 2009-08-10 21:59:33 -0400 |
|---|---|---|
| committer | Douglas Schilling Landgraf <dougsland@redhat.com> | 2009-08-10 21:59:33 -0400 |
| commit | 1537b0475bd1f694226d14373ed31298f2d0e8ef (patch) | |
| tree | ea9a1f536c39c229a7abee23c20f4e97e6704722 /linux/drivers | |
| parent | 84b86128572d1cef2f921fda840e365d8f01bdee (diff) | |
| download | mediapointer-dvb-s2-1537b0475bd1f694226d14373ed31298f2d0e8ef.tar.gz mediapointer-dvb-s2-1537b0475bd1f694226d14373ed31298f2d0e8ef.tar.bz2 | |
siano: read buffer overflow
From: Roel Kluin <roel.kluin@gmail.com>
With mode DEVICE_MODE_RAW_TUNER a read occurs past the end of smscore_fw_lkup[].
Subsequently an attempt is made to load the firmware from the resulting
filename.
Priority: normal
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Douglas Schilling Landgraf <dougsland@redhat.com>
Diffstat (limited to 'linux/drivers')
| -rw-r--r-- | linux/drivers/media/dvb/siano/smscoreapi.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/linux/drivers/media/dvb/siano/smscoreapi.c b/linux/drivers/media/dvb/siano/smscoreapi.c index 54f59f24e..c0306af09 100644 --- a/linux/drivers/media/dvb/siano/smscoreapi.c +++ b/linux/drivers/media/dvb/siano/smscoreapi.c @@ -816,7 +816,7 @@ int smscore_set_device_mode(struct smscore_device_t *coredev, int mode) sms_debug("set device mode to %d", mode); if (coredev->device_flags & SMS_DEVICE_FAMILY2) { - if (mode < DEVICE_MODE_DVBT || mode > DEVICE_MODE_RAW_TUNER) { + if (mode < DEVICE_MODE_DVBT || mode >= DEVICE_MODE_RAW_TUNER) { sms_err("invalid mode specified %d", mode); return -EINVAL; } |