commit 69f05c127e032c6f6bb9533562871ef7c9a2049e
author Ke Dong <kedong@google.com> Thu Feb 26 23:24:57 2015 -0800
committer Ke Dong <kedong@google.com> Sat Feb 28 19:00:34 2015 -0800
tree d12805fdc70c89222820164bd2ecfbcf4399194a
parent 4dd3a77532628e9219df683ee1d30da8b662ddbf

Add sanity check to prevent crash on bad value.

- Add sanity check for m88rs6000_read_signal_strength.

Google-Bug-Id: 19432272
Change-Id: I99b36cfc753429c55e4c0b89185975d7588a6f61

drivers/media/dvb/frontends/dvbsky_m88rs6000.c

diff --git a/drivers/media/dvb/frontends/dvbsky_m88rs6000.c b/drivers/media/dvb/frontends/dvbsky_m88rs6000.c
index 19197e8..e9f7e96 100644
--- a/drivers/media/dvb/frontends/dvbsky_m88rs6000.c
+++ b/drivers/media/dvb/frontends/dvbsky_m88rs6000.c
@@ -376,15 +376,28 @@
 	
 	val = m88rs6000_tuner_readreg(state, 0x5A);
 	RF_GC = val & 0x0f;
+	if(RF_GC >= ARRAY_SIZE(RFGS)) {
+		printk(KERN_ERR "%s: Invalid, RFGC=%d\n", __func__, RF_GC);
+		return -EINVAL;
+	}
 
 	val = m88rs6000_tuner_readreg(state, 0x5F);
 	IF_GC = val & 0x0f;
+	if(IF_GC >= ARRAY_SIZE(IFGS)) {
+		printk(KERN_ERR "%s: Invalid, IFGC=%d\n", __func__, IF_GC);
+		return -EINVAL;
+	}
+
 	
 	val = m88rs6000_tuner_readreg(state, 0x3F);
 	TIA_GC = (val >> 4) & 0x07;
 	
 	val = m88rs6000_tuner_readreg(state, 0x77);
 	BB_GC = (val >> 4) & 0x0f;
+	if(BB_GC >= ARRAY_SIZE(BBGS)) {
+		printk(KERN_ERR "%s: Invalid, BBGC=%d\n", __func__, BB_GC);
+		return -EINVAL;
+	}
 
 	val = m88rs6000_tuner_readreg(state, 0x76);
 	PGA2_GC = val & 0x3f;