[patch] [media] DVB: dvb_frontend: off by one in dtv_property_dump()

[Dan Carpenter]

If the tvp->cmd == DTV_MAX_COMMAND then we read past the end of the
array.

Signed-off-by: Dan Carpenter <erro...@gmail.com>

diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c 
b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 9827804..607e293 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -981,7 +981,7 @@ static void dtv_property_dump(struct dtv_property *tvp)
 {
        int i;
 
-       if (tvp->cmd <= 0 || tvp->cmd > DTV_MAX_COMMAND) {
+       if (tvp->cmd <= 0 || tvp->cmd >= DTV_MAX_COMMAND) {
                printk(KERN_WARNING "%s: tvp.cmd = 0x%08x undefined\n",
                        __func__, tvp->cmd);
                return;
--
To unsubscribe from this list: send the line "unsubscribe linux-media" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html