[PATCH 17/37] dvb: Fix integer overflow bug

[Michael Krufky]

From: Johannes Stezenbach <js@xxxxxxxxxxx>

Fix integer overflow bug in read_signal_strength()
reported by Anthony Leclerc.

Signed-off-by: Johannes Stezenbach <js@xxxxxxxxxxx>
Signed-off-by: Michael Krufky <mkrufky@xxxxxxxxxxx>

 drivers/media/dvb/frontends/or51132.c |    7 ++++++-
 drivers/media/dvb/frontends/or51211.c |    8 ++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

--- linux-2.6.14-git3.orig/drivers/media/dvb/frontends/or51132.c
+++ linux-2.6.14-git3/drivers/media/dvb/frontends/or51132.c
@@ -468,6 +468,7 @@
 	unsigned char snd_buf[2];
 	u8 rcvr_stat;
 	u16 snr_equ;
+	u32 signal_strength;
 	int usK;
 
 	snd_buf[0]=0x04;
@@ -503,7 +504,11 @@
 	usK = (rcvr_stat & 0x10) ? 3 : 0;
 
         /* The value reported back from the frontend will be FFFF=100% 0000=0% */
-	*strength = (((8952 - i20Log10(snr_equ) - usK*100)/3+5)*65535)/1000;
+	signal_strength = (((8952 - i20Log10(snr_equ) - usK*100)/3+5)*65535)/1000;
+	if (signal_strength > 0xffff)
+		*strength = 0xffff;
+	else
+		*strength = signal_strength;
 	dprintk("read_signal_strength %i\n",*strength);
 
 	return 0;
--- linux-2.6.14-git3.orig/drivers/media/dvb/frontends/or51211.c
+++ linux-2.6.14-git3/drivers/media/dvb/frontends/or51211.c
@@ -339,6 +339,7 @@
 	u8 rec_buf[2];
 	u8 snd_buf[4];
 	u8 snr_equ;
+	u32 signal_strength;
 
 	/* SNR after Equalizer */
 	snd_buf[0] = 0x04;
@@ -358,8 +359,11 @@
 	snr_equ = rec_buf[0] & 0xff;
 
 	/* The value reported back from the frontend will be FFFF=100% 0000=0% */
-	*strength = (((5334 - i20Log10(snr_equ))/3+5)*65535)/1000;
-
+	signal_strength = (((5334 - i20Log10(snr_equ))/3+5)*65535)/1000;
+	if (signal_strength > 0xffff)
+		*strength = 0xffff;
+	else
+		*strength = signal_strength;
 	dprintk("read_signal_strength %i\n",*strength);
 
 	return 0;