[PATCH] dvb: Fix integer overflow bug

Fix integer overflow bug in read_signal_strength() reported by Anthony
Leclerc.

Signed-off-by: Johannes Stezenbach <js@linuxtv.org>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/drivers/media/dvb/frontends/or51132.c b/drivers/media/dvb/frontends/or51132.c
index fc74c40..78bded8 100644 (file)
--- a/drivers/media/dvb/frontends/or51132.c
+++ b/drivers/media/dvb/frontends/or51132.c
@@ -468,6 +468,7 @@ static int or51132_read_signal_strength(struct dvb_frontend* fe, u16* strength)
        unsigned char snd_buf[2];
        u8 rcvr_stat;
        u16 snr_equ;
+       u32 signal_strength;
        int usK;
 
        snd_buf[0]=0x04;
@@ -503,7 +504,11 @@ static int or51132_read_signal_strength(struct dvb_frontend* fe, u16* strength)
        usK = (rcvr_stat & 0x10) ? 3 : 0;
 
         /* The value reported back from the frontend will be FFFF=100% 0000=0% */
-       *strength = (((8952 - i20Log10(snr_equ) - usK*100)/3+5)*65535)/1000;
+       signal_strength = (((8952 - i20Log10(snr_equ) - usK*100)/3+5)*65535)/1000;
+       if (signal_strength > 0xffff)
+               *strength = 0xffff;
+       else
+               *strength = signal_strength;
        dprintk("read_signal_strength %i\n",*strength);
 
        return 0;

diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
index 8a9db23..531f762 100644 (file)
--- a/drivers/media/dvb/frontends/or51211.c
+++ b/drivers/media/dvb/frontends/or51211.c
@@ -339,6 +339,7 @@ static int or51211_read_signal_strength(struct dvb_frontend* fe, u16* strength)
        u8 rec_buf[2];
        u8 snd_buf[4];
        u8 snr_equ;
+       u32 signal_strength;
 
        /* SNR after Equalizer */
        snd_buf[0] = 0x04;
@@ -358,8 +359,11 @@ static int or51211_read_signal_strength(struct dvb_frontend* fe, u16* strength)
        snr_equ = rec_buf[0] & 0xff;
 
        /* The value reported back from the frontend will be FFFF=100% 0000=0% */
-       *strength = (((5334 - i20Log10(snr_equ))/3+5)*65535)/1000;
-
+       signal_strength = (((5334 - i20Log10(snr_equ))/3+5)*65535)/1000;
+       if (signal_strength > 0xffff)
+               *strength = 0xffff;
+       else
+               *strength = signal_strength;
        dprintk("read_signal_strength %i\n",*strength);
 
        return 0;