summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2013-11-08 10:46:10 +0100
committerMark Brown <broonie@linaro.org>2013-11-19 20:07:07 +0100
commitb5f3d7af286a28e2fcc92debaba40844cb32bfb4 (patch)
tree3bcdc3ca7051b6afcd0f00cba955f4701150a3f6
parentASoC: rcar: fixup mod access before checking (diff)
downloadlinux-b5f3d7af286a28e2fcc92debaba40844cb32bfb4.tar.xz
linux-b5f3d7af286a28e2fcc92debaba40844cb32bfb4.zip
ASoC: rcar: off by one in rsnd_scu_set_route()
If "id == ARRAY_SIZE(routes)" then we read one space beyond the end of the routes[] array. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown <broonie@linaro.org>
-rw-r--r--sound/soc/sh/rcar/scu.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/soc/sh/rcar/scu.c b/sound/soc/sh/rcar/scu.c
index 1ab1bce6be7f..5e46ef2e8bb8 100644
--- a/sound/soc/sh/rcar/scu.c
+++ b/sound/soc/sh/rcar/scu.c
@@ -68,7 +68,7 @@ static int rsnd_scu_set_route(struct rsnd_priv *priv,
return 0;
id = rsnd_mod_id(mod);
- if (id < 0 || id > ARRAY_SIZE(routes))
+ if (id < 0 || id >= ARRAY_SIZE(routes))
return -EIO;
/*