redonkable/alistair23-linux
redonkable/alistair23-linux
1
0
Fork 0
Code Releases Activity

[media] af9033: prevent unintended underflow

Browse source 
As spotted by Dan Carpenter <dan.carpenter@oracle.com> (thanks!), we have
improperly used an unsigned variable in a calculation that may result in a
negative number. This may cause an unintended underflow if the interface
frequency of the tuner is > approx. 40MHz.
This patch should resolve the issue, following an approach similar to what is
used in af9013.c.

[crope@iki.fi: add Reported-by]
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans-Frieder Vogt <hfvogt@gmx.net>
Reviewed-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
Hans-Frieder Vogt 2012-10-03 05:25:40 -03:00 committed by Mauro Carvalho Chehab
parent 8b6faacd75
commit 182b967e11
1 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
drivers/media/dvb-frontends/af9033.c
View file

@ -408,7 +408,7 @@ static int af9033_set_frontend(struct dvb_frontend *fe)
{ {
struct af9033_state *state = fe->demodulator_priv; struct af9033_state *state = fe->demodulator_priv;
struct dtv_frontend_properties *c = &fe->dtv_property_cache; struct dtv_frontend_properties *c = &fe->dtv_property_cache;
int ret, i, spec_inv; int ret, i, spec_inv, sampling_freq;
u8 tmp, buf[3], bandwidth_reg_val; u8 tmp, buf[3], bandwidth_reg_val;
u32 if_frequency, freq_cw, adc_freq; u32 if_frequency, freq_cw, adc_freq;
@ -465,18 +465,20 @@ static int af9033_set_frontend(struct dvb_frontend *fe)
else else
if_frequency = 0; if_frequency = 0;
while (if_frequency > (adc_freq / 2)) sampling_freq = if_frequency;
if_frequency -= adc_freq;
if (if_frequency >= 0) while (sampling_freq > (adc_freq / 2))
sampling_freq -= adc_freq;
if (sampling_freq >= 0)
spec_inv *= -1; spec_inv *= -1;
else else
if_frequency *= -1; sampling_freq *= -1;
freq_cw = af9033_div(state, if_frequency, adc_freq, 23ul); freq_cw = af9033_div(state, sampling_freq, adc_freq, 23ul);
if (spec_inv == -1) if (spec_inv == -1)
freq_cw *= -1; freq_cw = 0x800000 - freq_cw;
/* get adc multiplies */ /* get adc multiplies */
ret = af9033_rd_reg(state, 0x800045, &tmp); ret = af9033_rd_reg(state, 0x800045, &tmp);