[PATCH] dvb_frontend: Fix possible read out of bounds

[Ole Ernst]

Check if index is within bounds _before_ accessing the value.

Signed-off-by: Ole Ernst <olebo...@gmx.com>
---
 drivers/media/dvb-core/dvb_frontend.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/media/dvb-core/dvb_frontend.c 
b/drivers/media/dvb-core/dvb_frontend.c
index 2d32c13..6ce435a 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -1279,7 +1279,7 @@ static int dtv_property_process_get(struct dvb_frontend 
*fe,
        switch(tvp->cmd) {
        case DTV_ENUM_DELSYS:
                ncaps = 0;
-               while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) {
+               while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {
                        tvp->u.buffer.data[ncaps] = fe->ops.delsys[ncaps];
                        ncaps++;
                }
@@ -1596,7 +1596,7 @@ static int dvbv5_set_delivery_system(struct dvb_frontend 
*fe,
         * supported
         */
        ncaps = 0;
-       while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) {
+       while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {
                if (fe->ops.delsys[ncaps] == desired_system) {
                        c->delivery_system = desired_system;
                        dev_dbg(fe->dvb->device,
@@ -1628,7 +1628,7 @@ static int dvbv5_set_delivery_system(struct dvb_frontend 
*fe,
        * of the desired system
        */
        ncaps = 0;
-       while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) {
+       while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {
                if (dvbv3_type(fe->ops.delsys[ncaps]) == type)
                        delsys = fe->ops.delsys[ncaps];
                ncaps++;
@@ -1703,7 +1703,7 @@ static int dvbv3_set_delivery_system(struct dvb_frontend 
*fe)
         * DVBv3 standard
         */
        ncaps = 0;
-       while (fe->ops.delsys[ncaps] && ncaps < MAX_DELSYS) {
+       while (ncaps < MAX_DELSYS && fe->ops.delsys[ncaps]) {
                if (dvbv3_type(fe->ops.delsys[ncaps]) != DVBV3_UNKNOWN) {
                        delsys = fe->ops.delsys[ncaps];
                        break;
-- 
1.9.0

--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html