aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGianluca Gennari <gennarone@gmail.com>2013-06-02 17:24:24 -0300
committerMauro Carvalho Chehab <mchehab@redhat.com>2013-06-17 15:25:34 -0300
commita908eb9936ba06678720226feed891d01827066f (patch)
treeb71b42990faa60e8a730d7058c70fae3eecf9a61
parentaf44ad5edd1eb6ca92ed5be48e0004e1f04bf219 (diff)
downloadvexpress-lsk-a908eb9936ba06678720226feed891d01827066f.tar.gz
[media] rtl28xxu: fix buffer overflow when probing Rafael Micro r820t tuner
As suggested by Antti, this patch replaces: https://patchwork.kernel.org/patch/2649861/ The buffer overflow is fixed by reading only the r820t ID register. Signed-off-by: Gianluca Gennari <gennarone@gmail.com> Acked-by: Antti Palosaari <crope@iki.fi> Reviewed-by: Antti Palosaari <crope@iki.fi> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
-rw-r--r--drivers/media/usb/dvb-usb-v2/rtl28xxu.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 22015fe1a0f..2cc8ec70e3b 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -376,7 +376,7 @@ static int rtl2832u_read_config(struct dvb_usb_device *d)
struct rtl28xxu_req req_mxl5007t = {0xd9c0, CMD_I2C_RD, 1, buf};
struct rtl28xxu_req req_e4000 = {0x02c8, CMD_I2C_RD, 1, buf};
struct rtl28xxu_req req_tda18272 = {0x00c0, CMD_I2C_RD, 2, buf};
- struct rtl28xxu_req req_r820t = {0x0034, CMD_I2C_RD, 5, buf};
+ struct rtl28xxu_req req_r820t = {0x0034, CMD_I2C_RD, 1, buf};
dev_dbg(&d->udev->dev, "%s:\n", __func__);
@@ -481,9 +481,9 @@ static int rtl2832u_read_config(struct dvb_usb_device *d)
goto found;
}
- /* check R820T by reading tuner stats at I2C addr 0x1a */
+ /* check R820T ID register; reg=00 val=69 */
ret = rtl28xxu_ctrl_msg(d, &req_r820t);
- if (ret == 0) {
+ if (ret == 0 && buf[0] == 0x69) {
priv->tuner = TUNER_RTL2832_R820T;
priv->tuner_name = "R820T";
goto found;