linux-kernel - Re: [PATCH] DVB: negative internal->sub

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 26 Jan 2009 22:40:39 -0800
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Roel Kluin <roel.kluin@...il.com>
Cc:	mchehab@...hat.com, video4linux-list@...hat.com,
	lkml <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] DVB: negative internal->sub_range won't get noticed

On Mon, 19 Jan 2009 00:35:47 +0100 Roel Kluin <roel.kluin@...il.com> wrote:

> internal->sub_range is unsigned, a negative won't get noticed.
> 
> Signed-off-by: Roel Kluin <roel.kluin@...il.com>
> ---
> diff --git a/drivers/media/dvb/frontends/stb0899_algo.c b/drivers/media/dvb/frontends/stb0899_algo.c
> index 83dc7e1..2ea32da 100644
> --- a/drivers/media/dvb/frontends/stb0899_algo.c
> +++ b/drivers/media/dvb/frontends/stb0899_algo.c
> @@ -464,13 +464,14 @@ static void next_sub_range(struct stb0899_state *state)
>  
>  	if (internal->sub_dir > 0) {
>  		old_sub_range = internal->sub_range;
> -		internal->sub_range = MIN((internal->srch_range / 2) -
> +		if (internal->tuner_offst + internal->sub_range / 2 >=
> +				internal->srch_range / 2)
> +			internal->sub_range = 0;
> +		else
> +			internal->sub_range = MIN((internal->srch_range / 2) -
>  					  (internal->tuner_offst + internal->sub_range / 2),
>  					   internal->sub_range);
>  
> -		if (internal->sub_range < 0)
> -			internal->sub_range = 0;
> -
>  		internal->tuner_offst += (old_sub_range + internal->sub_range) / 2;
>  	}

I hope someone understands that function :(

Do we actually need that test at all?  Perhaps it has never triggered? 
Perhaps values in the 0x80000000 - 0xffffffff are actually OK?

This driver has managed to get itself a secret private version of the
min(), max() and abs() macros.  They're buggy - they reference their
argument multiple times.  The driver should be converted to use the
kernel.h versions.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/