From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Date: Tue, 28 Oct 2014 13:07:03 +0000 (-0200)
Subject: [media] lgdt3306a: don't go past the buffer
X-Git-Tag: v5.15~14799^2~1310
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=a132fef816606ebe9d20895b1535582bfede12a4;p=platform%2Fkernel%2Flinux-starfive.git

[media] lgdt3306a: don't go past the buffer

As warned by smatch:
	drivers/media/dvb-frontends/lgdt3306a.c:1354 log10_x1000() error: buffer overflow 'valx_x10' 14 <= 14
	drivers/media/dvb-frontends/lgdt3306a.c:1355 log10_x1000() error: buffer overflow 'log10x_x1000' 14 <= 14

There's a potential of returning a value out of the buffer. Fix it.

While here, remove the ugly braced block.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
---

diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c
index c8af071..92affe1 100644
--- a/drivers/media/dvb-frontends/lgdt3306a.c
+++ b/drivers/media/dvb-frontends/lgdt3306a.c
@@ -1319,6 +1319,7 @@ static u32 log10_x1000(u32 x)
 	static u32 valx_x10[]     = {  10,  11,  13,  15,  17,  20,  25,  33,  41,  50,  59,  73,  87,  100 };
 	static u32 log10x_x1000[] = {   0,  41, 114, 176, 230, 301, 398, 518, 613, 699, 771, 863, 939, 1000 };
 	static u32 nelems = sizeof(valx_x10)/sizeof(valx_x10[0]);
+	u32 diff_val, step_val, step_log10;
 	u32 log_val = 0;
 	u32 i;
 
@@ -1348,15 +1349,16 @@ static u32 log10_x1000(u32 x)
 		if (valx_x10[i] >= x)
 			break;
 	}
+	if (i == nelems)
+		return log_val + log10x_x1000[i - 1];
 
-	{
-		u32 diff_val   = x - valx_x10[i-1];
-		u32 step_val   = valx_x10[i] - valx_x10[i-1];
-		u32 step_log10 = log10x_x1000[i] - log10x_x1000[i-1];
-		/* do a linear interpolation to get in-between values */
-		return log_val + log10x_x1000[i-1] +
-			((diff_val*step_log10) / step_val);
-	}
+	diff_val   = x - valx_x10[i-1];
+	step_val   = valx_x10[i] - valx_x10[i - 1];
+	step_log10 = log10x_x1000[i] - log10x_x1000[i - 1];
+
+	/* do a linear interpolation to get in-between values */
+	return log_val + log10x_x1000[i - 1] +
+		((diff_val*step_log10) / step_val);
 }
 
 static u32 lgdt3306a_calculate_snr_x100(struct lgdt3306a_state *state)