libdvbv5: Don't go past the size of dvb_v5_attr_names
authorMauro Carvalho Chehab <m.chehab@samsung.com>
Sun, 31 Aug 2014 23:57:51 +0000 (20:57 -0300)
committerMauro Carvalho Chehab <m.chehab@samsung.com>
Sun, 31 Aug 2014 23:58:52 +0000 (20:58 -0300)
commit04accf23bf8f6e3fbcfbc0ff4a8430edd6832d76
tree627f58bae4e49a060cda244771bef0e9a8b018a7
parent08253c317be2aa523fe5a4f6523a1140031b2327
libdvbv5: Don't go past the size of dvb_v5_attr_names

As reported by Coverity:

4. cond_between: Checking cmd < 256 implies that cmd has the value which is between 0 and 255 (inclusive) on the true branch.
469        if (cmd >= 0 && cmd < DTV_USER_COMMAND_START)

CID 1054610 (#1 of 1): Out-of-bounds read (OVERRUN)5. overrun-local: Overrunning array dvb_v5_attr_names of 70 8-byte elements at element index 255 (byte offset 2040) using index cmd (which evaluates to 255).
470                return dvb_v5_attr_names[cmd];
471        else if (cmd >= 0 && cmd <= DTV_MAX_STAT_COMMAND)
472                return dvb_user_attr_names[cmd - DTV_USER_COMMAND_START];
473        return NULL;

This wouldn't be a problem if the function was just internal,
but this is part of the public functions.

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
lib/libdvbv5/dvb-fe.c