summaryrefslogtreecommitdiff
path: root/drivers/media
diff options
context:
space:
mode:
authorMauro Carvalho Chehab <mchehab@s-opensource.com>2016-09-22 20:09:18 +0300
committerMauro Carvalho Chehab <mchehab@s-opensource.com>2016-09-22 20:14:22 +0300
commit3cc2691227203c00cac1d82d6b0772224d5c87b2 (patch)
tree5fca5d9d19b039f8937c14b9c2a04ae16e487d37 /drivers/media
parente837d85c614e8d6e2d93daed972874ea3a8daec7 (diff)
downloadlinux-3cc2691227203c00cac1d82d6b0772224d5c87b2.tar.xz
[media] ttusb_dec: avoid the risk of go past buffer
Fixes this smatch warning: drivers/media/usb/ttusb-dec/ttusb_dec.c:243 ttusb_dec_handle_irq() error: buffer overflow 'rc_keys' 26 <= 126 As the RC keys should be enabled previously, via: set_bit(rc_keys[i], input_dev->keybit); It wouldn't go past the buffer in practice. Yet, as bad things may happen when going past buffer, it doesn't hurt adding a check here. While here, fix CodingStyle issues on the routine. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Diffstat (limited to 'drivers/media')
-rw-r--r--drivers/media/usb/ttusb-dec/ttusb_dec.c30
1 files changed, 18 insertions, 12 deletions
diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c
index 4e36e24cb3a6..4e7671a3a1e4 100644
--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c
@@ -206,7 +206,7 @@ static void ttusb_dec_set_model(struct ttusb_dec *dec,
static void ttusb_dec_handle_irq( struct urb *urb)
{
- struct ttusb_dec * dec = urb->context;
+ struct ttusb_dec *dec = urb->context;
char *buffer = dec->irq_buffer;
int retval;
@@ -227,25 +227,31 @@ static void ttusb_dec_handle_irq( struct urb *urb)
goto exit;
}
- if( (buffer[0] == 0x1) && (buffer[2] == 0x15) ) {
- /* IR - Event */
- /* this is an fact a bit too simple implementation;
+ if ((buffer[0] == 0x1) && (buffer[2] == 0x15)) {
+ /*
+ * IR - Event
+ *
+ * this is an fact a bit too simple implementation;
* the box also reports a keyrepeat signal
* (with buffer[3] == 0x40) in an intervall of ~100ms.
* But to handle this correctly we had to imlemenent some
* kind of timer which signals a 'key up' event if no
* keyrepeat signal is received for lets say 200ms.
* this should/could be added later ...
- * for now lets report each signal as a key down and up*/
- dprintk("%s:rc signal:%d\n", __func__, buffer[4]);
- input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 1);
- input_sync(dec->rc_input_dev);
- input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 0);
- input_sync(dec->rc_input_dev);
+ * for now lets report each signal as a key down and up
+ */
+ if (buffer[4] - 1 < ARRAY_SIZE(rc_keys)) {
+ dprintk("%s:rc signal:%d\n", __func__, buffer[4]);
+ input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 1);
+ input_sync(dec->rc_input_dev);
+ input_report_key(dec->rc_input_dev, rc_keys[buffer[4] - 1], 0);
+ input_sync(dec->rc_input_dev);
+ }
}
-exit: retval = usb_submit_urb(urb, GFP_ATOMIC);
- if(retval)
+exit:
+ retval = usb_submit_urb(urb, GFP_ATOMIC);
+ if (retval)
printk("%s - usb_commit_urb failed with result: %d\n",
__func__, retval);
}