Commit b90ed914 authored by Johannes Stezenbach's avatar Johannes Stezenbach Committed by Linus Torvalds

[PATCH] dvb: Fix integer overflow bug

Fix integer overflow bug in read_signal_strength() reported by Anthony
Leclerc.
Signed-off-by: default avatarJohannes Stezenbach <js@linuxtv.org>
Signed-off-by: default avatarMichael Krufky <mkrufky@linuxtv.org>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 5c15c0b4
...@@ -468,6 +468,7 @@ static int or51132_read_signal_strength(struct dvb_frontend* fe, u16* strength) ...@@ -468,6 +468,7 @@ static int or51132_read_signal_strength(struct dvb_frontend* fe, u16* strength)
unsigned char snd_buf[2]; unsigned char snd_buf[2];
u8 rcvr_stat; u8 rcvr_stat;
u16 snr_equ; u16 snr_equ;
u32 signal_strength;
int usK; int usK;
snd_buf[0]=0x04; snd_buf[0]=0x04;
...@@ -503,7 +504,11 @@ static int or51132_read_signal_strength(struct dvb_frontend* fe, u16* strength) ...@@ -503,7 +504,11 @@ static int or51132_read_signal_strength(struct dvb_frontend* fe, u16* strength)
usK = (rcvr_stat & 0x10) ? 3 : 0; usK = (rcvr_stat & 0x10) ? 3 : 0;
/* The value reported back from the frontend will be FFFF=100% 0000=0% */ /* The value reported back from the frontend will be FFFF=100% 0000=0% */
*strength = (((8952 - i20Log10(snr_equ) - usK*100)/3+5)*65535)/1000; signal_strength = (((8952 - i20Log10(snr_equ) - usK*100)/3+5)*65535)/1000;
if (signal_strength > 0xffff)
*strength = 0xffff;
else
*strength = signal_strength;
dprintk("read_signal_strength %i\n",*strength); dprintk("read_signal_strength %i\n",*strength);
return 0; return 0;
......
...@@ -339,6 +339,7 @@ static int or51211_read_signal_strength(struct dvb_frontend* fe, u16* strength) ...@@ -339,6 +339,7 @@ static int or51211_read_signal_strength(struct dvb_frontend* fe, u16* strength)
u8 rec_buf[2]; u8 rec_buf[2];
u8 snd_buf[4]; u8 snd_buf[4];
u8 snr_equ; u8 snr_equ;
u32 signal_strength;
/* SNR after Equalizer */ /* SNR after Equalizer */
snd_buf[0] = 0x04; snd_buf[0] = 0x04;
...@@ -358,8 +359,11 @@ static int or51211_read_signal_strength(struct dvb_frontend* fe, u16* strength) ...@@ -358,8 +359,11 @@ static int or51211_read_signal_strength(struct dvb_frontend* fe, u16* strength)
snr_equ = rec_buf[0] & 0xff; snr_equ = rec_buf[0] & 0xff;
/* The value reported back from the frontend will be FFFF=100% 0000=0% */ /* The value reported back from the frontend will be FFFF=100% 0000=0% */
*strength = (((5334 - i20Log10(snr_equ))/3+5)*65535)/1000; signal_strength = (((5334 - i20Log10(snr_equ))/3+5)*65535)/1000;
if (signal_strength > 0xffff)
*strength = 0xffff;
else
*strength = signal_strength;
dprintk("read_signal_strength %i\n",*strength); dprintk("read_signal_strength %i\n",*strength);
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment