diff mbox

[113/237] ASoC: rcar: off by one in rsnd_scu_set_route()

Message ID 1387000406-29111-114-git-send-email-horms+renesas@verge.net.au (mailing list archive)
State New, archived
Headers show

Commit Message

Simon Horman Dec. 14, 2013, 5:51 a.m. UTC 
From: Dan Carpenter <dan.carpenter@oracle.com>

If "id == ARRAY_SIZE(routes)" then we read one space beyond the end of
the routes[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>
(cherry picked from commit b5f3d7af286a28e2fcc92debaba40844cb32bfb4)
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
---
 sound/soc/sh/rcar/scu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox

Patch

diff --git a/sound/soc/sh/rcar/scu.c b/sound/soc/sh/rcar/scu.c
index f4453e3..fa8fa15 100644
--- a/sound/soc/sh/rcar/scu.c
+++ b/sound/soc/sh/rcar/scu.c
@@ -68,7 +68,7 @@  static int rsnd_scu_set_route(struct rsnd_priv *priv,
 		return 0;
 
 	id = rsnd_mod_id(mod);
-	if (id < 0 || id > ARRAY_SIZE(routes))
+	if (id < 0 || id >= ARRAY_SIZE(routes))
 		return -EIO;
 
 	/*