[media] si4713: si4713_set_rds_radio_text overwrites terminating \0

si4713_set_rds_radio_text will overwrite the terminating zero at the
end of the rds radio text string in order to send out a carriage return
as per the RDS spec.
Use a separate char buffer for the CR instead of corrupting the control
string.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Tested-by: Eduardo Valentin <edubezval@gmail.com>
Acked-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>

diff --git a/drivers/media/radio/si4713/si4713.c b/drivers/media/radio/si4713/si4713.c
index 097d4e09b491cca8644a76b13af12d787f705bfd..17e0106a771b5c57f319fcc87a242b9bf5d03b18 100644 (file)
--- a/drivers/media/radio/si4713/si4713.c
+++ b/drivers/media/radio/si4713/si4713.c
@@ -831,8 +831,9 @@ static int si4713_set_rds_ps_name(struct si4713_device *sdev, char *ps_name)
        return rval;
 }
 
-static int si4713_set_rds_radio_text(struct si4713_device *sdev, char *rt)
+static int si4713_set_rds_radio_text(struct si4713_device *sdev, const char *rt)
 {
+       static const char cr[RDS_RADIOTEXT_BLK_SIZE] = { RDS_CARRIAGE_RETURN, 0 };
        int rval = 0, i;
        u16 t_index = 0;
        u8 b_index = 0, cr_inserted = 0;
@@ -856,7 +857,7 @@ static int si4713_set_rds_radio_text(struct si4713_device *sdev, char *rt)
                        for (i = 0; i < RDS_RADIOTEXT_BLK_SIZE; i++) {
                                if (!rt[t_index + i] ||
                                    rt[t_index + i] == RDS_CARRIAGE_RETURN) {
-                                       rt[t_index + i] = RDS_CARRIAGE_RETURN;
+                                       rt = cr;
                                        cr_inserted = 1;
                                        break;
                                }