Hi!
I'm looking at this code in drivers/media/dvb-frontends/m88ds3103.c in
the m88ds3103_set_frontend() function, line 600 (give or take):
s32tmp = 0x10000 * (tuner_frequency - c->frequency);
s32tmp = DIV_ROUND_CLOSEST(s32tmp, priv->mclk_khz);
if (s32tmp < 0)
s32tmp += 0x10000;
There is code that tries to handle negative s32tmp, so I assume that
negative s32tmp is a possibility. Further, priv->mclk_khz is an unsigned
type as far as I can tell. But then we have this comment for the
DIV_ROUND_CLOSEST macro:
/*
* Divide positive or negative dividend by positive divisor and round
* to closest integer. Result is undefined for negative divisors and
* for negative dividends if the divisor variable type is unsigned.
*/
#define DIV_ROUND_CLOSEST(x, divisor)( \
I don't know how bad this is, and what the consequences of garbage are,
but from here it looks like a problem waiting to happen...
Cheers,
Peter
