From 86b2749ba79e78130dd9f678aa52d57992fbdf1c Mon Sep 17 00:00:00 2001 From: Hans Verkuil Date: Fri, 15 Apr 2016 12:35:31 -0300 Subject: [media] vivid: fix smatch errors The smatch utility got really confused about the grp % 22 code. Rewrote it so it now understands that there really isn't a buffer overwrite. vivid-rds-gen.c:82 vivid_rds_generate() error: buffer overflow 'rds->psname' 9 <= 43 vivid-rds-gen.c:83 vivid_rds_generate() error: buffer overflow 'rds->psname' 9 <= 42 vivid-rds-gen.c:89 vivid_rds_generate() error: buffer overflow 'rds->radiotext' 65 <= 84 vivid-rds-gen.c:90 vivid_rds_generate() error: buffer overflow 'rds->radiotext' 65 <= 85 vivid-rds-gen.c:92 vivid_rds_generate() error: buffer overflow 'rds->radiotext' 65 <= 86 vivid-rds-gen.c:93 vivid_rds_generate() error: buffer overflow 'rds->radiotext' 65 <= 87 Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab --- drivers/media/platform/vivid/vivid-rds-gen.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) (limited to 'drivers/media') diff --git a/drivers/media/platform/vivid/vivid-rds-gen.c b/drivers/media/platform/vivid/vivid-rds-gen.c index c382343..53c7777 100644 --- a/drivers/media/platform/vivid/vivid-rds-gen.c +++ b/drivers/media/platform/vivid/vivid-rds-gen.c @@ -55,6 +55,7 @@ void vivid_rds_generate(struct vivid_rds_gen *rds) { struct v4l2_rds_data *data = rds->data; unsigned grp; + unsigned idx; struct tm tm; unsigned date; unsigned time; @@ -73,24 +74,26 @@ void vivid_rds_generate(struct vivid_rds_gen *rds) case 0 ... 3: case 22 ... 25: case 44 ... 47: /* Group 0B */ + idx = (grp % 22) % 4; data[1].lsb |= (rds->ta << 4) | (rds->ms << 3); - data[1].lsb |= vivid_get_di(rds, grp % 22); + data[1].lsb |= vivid_get_di(rds, idx); data[1].msb |= 1 << 3; data[2].lsb = rds->picode & 0xff; data[2].msb = rds->picode >> 8; data[2].block = V4L2_RDS_BLOCK_C_ALT | (V4L2_RDS_BLOCK_C_ALT << 3); - data[3].lsb = rds->psname[2 * (grp % 22) + 1]; - data[3].msb = rds->psname[2 * (grp % 22)]; + data[3].lsb = rds->psname[2 * idx + 1]; + data[3].msb = rds->psname[2 * idx]; break; case 4 ... 19: case 26 ... 41: /* Group 2A */ - data[1].lsb |= (grp - 4) % 22; + idx = ((grp - 4) % 22) % 16; + data[1].lsb |= idx; data[1].msb |= 4 << 3; - data[2].msb = rds->radiotext[4 * ((grp - 4) % 22)]; - data[2].lsb = rds->radiotext[4 * ((grp - 4) % 22) + 1]; + data[2].msb = rds->radiotext[4 * idx]; + data[2].lsb = rds->radiotext[4 * idx + 1]; data[2].block = V4L2_RDS_BLOCK_C | (V4L2_RDS_BLOCK_C << 3); - data[3].msb = rds->radiotext[4 * ((grp - 4) % 22) + 2]; - data[3].lsb = rds->radiotext[4 * ((grp - 4) % 22) + 3]; + data[3].msb = rds->radiotext[4 * idx + 2]; + data[3].lsb = rds->radiotext[4 * idx + 3]; break; case 56: /* -- cgit v1.1