Messages in this thread Patch in this message | | | From | xypron.glpk@gmx ... | Subject | [PATCH 1/1] Reading array out of bound in ds3000_read_snr | Date | Thu, 27 Feb 2014 16:00:53 +0100 |
| |
From: Heinrich Schuchardt <xypron.glpk@gmx.de>
An attempt was made to read dvbs2_snr_tab[80], though dvbs2_snr_tab has only 80 elements.
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de> --- drivers/media/dvb-frontends/ds3000.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c index 1e344b0..335daef 100644 --- a/drivers/media/dvb-frontends/ds3000.c +++ b/drivers/media/dvb-frontends/ds3000.c @@ -616,7 +616,7 @@ static int ds3000_read_snr(struct dvb_frontend *fe, u16 *snr) snr_reading = dvbs2_noise_reading / tmp; if (snr_reading > 80) snr_reading = 80; - *snr = -(dvbs2_snr_tab[snr_reading] / 1000); + *snr = -(dvbs2_snr_tab[snr_reading - 1] / 1000); } dprintk("%s: raw / cooked = 0x%02x / 0x%04x\n", __func__, snr_reading, *snr); -- 1.7.10.4
| |