aboutsummaryrefslogtreecommitdiff
path: root/drivers/media/video
diff options
context:
space:
mode:
authorTrent Piepho <xyzzy@speakeasy.org>2006-08-07 19:43:21 -0300
committerMauro Carvalho Chehab <mchehab@infradead.org>2006-09-26 12:30:31 -0300
commit18795eb98d117dbb96fadfc17a7da44c93857fd6 (patch)
treeca4a4209c302bac8d16d30f6eee85523db3a0c8e /drivers/media/video
parent40346b290fcbf95d17c05ffe5101a1b5de8af548 (diff)
V4L/DVB (4488): Fix possible crash in Hauppauge eeprom reading
If an eeprom defined two tuners and they supported more than eight standards combined (as opposed to each), it would overflow an array. Signed-off-by: Trent Piepho <xyzzy@speakeasy.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Diffstat (limited to 'drivers/media/video')
-rw-r--r--drivers/media/video/tveeprom.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c
index d95529e8e51..cd1502ac956 100644
--- a/drivers/media/video/tveeprom.c
+++ b/drivers/media/video/tveeprom.c
@@ -605,6 +605,8 @@ void tveeprom_hauppauge_analog(struct i2c_client *c, struct tveeprom *tvee,
tvee->tuner_formats |= hauppauge_tuner_fmt[i].id;
t_fmt_name1[j++] = hauppauge_tuner_fmt[i].name;
}
+ }
+ for (i = j = 0; i < 8; i++) {
if (t_format2 & (1 << i)) {
tvee->tuner2_formats |= hauppauge_tuner_fmt[i].id;
t_fmt_name2[j++] = hauppauge_tuner_fmt[i].name;