aboutsummaryrefslogtreecommitdiff
path: root/drivers/media/dvb
diff options
context:
space:
mode:
authorJohannes Stezenbach <js@linuxtv.org>2005-11-08 21:35:25 -0800
committerLinus Torvalds <torvalds@g5.osdl.org>2005-11-09 07:56:03 -0800
commitb90ed914e513a6ad6184f7a46a0df0888dcfc177 (patch)
tree31c9b27b6140499dc930e47f6dd1d7cbe0893584 /drivers/media/dvb
parent5c15c0b4fa850543b8ccfcf93686d24456cc384d (diff)
[PATCH] dvb: Fix integer overflow bug
Fix integer overflow bug in read_signal_strength() reported by Anthony Leclerc. Signed-off-by: Johannes Stezenbach <js@linuxtv.org> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/media/dvb')
-rw-r--r--drivers/media/dvb/frontends/or51132.c7
-rw-r--r--drivers/media/dvb/frontends/or51211.c8
2 files changed, 12 insertions, 3 deletions
diff --git a/drivers/media/dvb/frontends/or51132.c b/drivers/media/dvb/frontends/or51132.c
index fc74c40d647..78bded861d0 100644
--- a/drivers/media/dvb/frontends/or51132.c
+++ b/drivers/media/dvb/frontends/or51132.c
@@ -468,6 +468,7 @@ static int or51132_read_signal_strength(struct dvb_frontend* fe, u16* strength)
unsigned char snd_buf[2];
u8 rcvr_stat;
u16 snr_equ;
+ u32 signal_strength;
int usK;
snd_buf[0]=0x04;
@@ -503,7 +504,11 @@ static int or51132_read_signal_strength(struct dvb_frontend* fe, u16* strength)
usK = (rcvr_stat & 0x10) ? 3 : 0;
/* The value reported back from the frontend will be FFFF=100% 0000=0% */
- *strength = (((8952 - i20Log10(snr_equ) - usK*100)/3+5)*65535)/1000;
+ signal_strength = (((8952 - i20Log10(snr_equ) - usK*100)/3+5)*65535)/1000;
+ if (signal_strength > 0xffff)
+ *strength = 0xffff;
+ else
+ *strength = signal_strength;
dprintk("read_signal_strength %i\n",*strength);
return 0;
diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
index 8a9db23dd1b..531f76246e5 100644
--- a/drivers/media/dvb/frontends/or51211.c
+++ b/drivers/media/dvb/frontends/or51211.c
@@ -339,6 +339,7 @@ static int or51211_read_signal_strength(struct dvb_frontend* fe, u16* strength)
u8 rec_buf[2];
u8 snd_buf[4];
u8 snr_equ;
+ u32 signal_strength;
/* SNR after Equalizer */
snd_buf[0] = 0x04;
@@ -358,8 +359,11 @@ static int or51211_read_signal_strength(struct dvb_frontend* fe, u16* strength)
snr_equ = rec_buf[0] & 0xff;
/* The value reported back from the frontend will be FFFF=100% 0000=0% */
- *strength = (((5334 - i20Log10(snr_equ))/3+5)*65535)/1000;
-
+ signal_strength = (((5334 - i20Log10(snr_equ))/3+5)*65535)/1000;
+ if (signal_strength > 0xffff)
+ *strength = 0xffff;
+ else
+ *strength = signal_strength;
dprintk("read_signal_strength %i\n",*strength);
return 0;