From e08aadf2061423af765135be1de3acff7da6e4ce Mon Sep 17 00:00:00 2001 From: Mauro Carvalho Chehab Date: Sat, 6 Sep 2014 00:28:50 -0300 Subject: [PATCH] libdvbv5: Fix the property limits check As reported by Coverity: 474 if (cmd >= DTV_USER_COMMAND_START && cmd <= DTV_MAX_STAT_COMMAND) >>> CID 1237264: Out-of-bounds read (OVERRUN) >>> Overrunning array "dvb_user_attr_names" of 13 8-byte elements at element index 260 (byte offset 2080) using index "cmd - 256" (which evaluates to 260). 475 return dvb_user_attr_names[cmd - DTV_USER_COMMAND_START]; 476 return NULL; Signed-off-by: Mauro Carvalho Chehab --- lib/libdvbv5/dvb-fe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/libdvbv5/dvb-fe.c b/lib/libdvbv5/dvb-fe.c index 61a9dce..5352947 100644 --- a/lib/libdvbv5/dvb-fe.c +++ b/lib/libdvbv5/dvb-fe.c @@ -471,7 +471,7 @@ const char *const *dvb_attr_names(int cmd) if (cmd >= 0 && cmd < DTV_MAX_COMMAND) return dvb_v5_attr_names[cmd]; - if (cmd >= DTV_USER_COMMAND_START && cmd <= DTV_MAX_STAT_COMMAND) + if (cmd >= DTV_USER_COMMAND_START && cmd <= DTV_MAX_USER_COMMAND) return dvb_user_attr_names[cmd - DTV_USER_COMMAND_START]; return NULL; } -- 2.7.4