media: dvb: digitv: remove unused array element 0
authorSean Young <sean@mess.org>
Thu, 12 Mar 2020 09:22:45 +0000 (10:22 +0100)
committerMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Tue, 21 Apr 2020 10:53:53 +0000 (12:53 +0200)
The first element of the key array is not used. Remove it, and
along with it a uninitialized memory read.

This should fix the rc debug message.

Link: https://www.spinics.net/lists/kernel/msg3374861.html
Suggested-by: Phong Tran <tranmanphong@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
drivers/media/usb/dvb-usb/digitv.c

index 906438c5a40f64301abcba85ce06817f0cd3733b..2a4b7ccd54899fe4a2235b0eb2588313fc774c81 100644 (file)
@@ -230,14 +230,15 @@ static struct rc_map_table rc_map_digitv_table[] = {
 
 static int digitv_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
 {
+       struct rc_map_table *entry;
        int ret, i;
-       u8 key[5];
+       u8 key[4];
        u8 b[4] = { 0 };
 
        *event = 0;
        *state = REMOTE_NO_KEY_PRESSED;
 
-       ret = digitv_ctrl_msg(d, USB_READ_REMOTE, 0, NULL, 0, &key[1], 4);
+       ret = digitv_ctrl_msg(d, USB_READ_REMOTE, 0, NULL, 0, key, 4);
        if (ret)
                return ret;
 
@@ -248,20 +249,21 @@ static int digitv_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
                return ret;
 
        /* if something is inside the buffer, simulate key press */
-       if (key[1] != 0)
-       {
-                 for (i = 0; i < d->props.rc.legacy.rc_map_size; i++) {
-                       if (rc5_custom(&d->props.rc.legacy.rc_map_table[i]) == key[1] &&
-                           rc5_data(&d->props.rc.legacy.rc_map_table[i]) == key[2]) {
-                               *event = d->props.rc.legacy.rc_map_table[i].keycode;
+       if (key[0] != 0) {
+               for (i = 0; i < d->props.rc.legacy.rc_map_size; i++) {
+                       entry = &d->props.rc.legacy.rc_map_table[i];
+
+                       if (rc5_custom(entry) == key[0] &&
+                           rc5_data(entry) == key[1]) {
+                               *event = entry->keycode;
                                *state = REMOTE_KEY_PRESSED;
                                return 0;
                        }
                }
+
+               deb_rc("key: %*ph\n", 4, key);
        }
 
-       if (key[0] != 0)
-               deb_rc("key: %*ph\n", 5, key);
        return 0;
 }