| From f1a26ba277f1c8ff97e4ee81223dca356e88190c Mon Sep 17 00:00:00 2001 |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| Date: Fri, 8 Nov 2013 12:46:10 +0300 |
| Subject: ASoC: rcar: off by one in rsnd_scu_set_route() |
| |
| If "id == ARRAY_SIZE(routes)" then we read one space beyond the end of |
| the routes[] array. |
| |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> |
| Signed-off-by: Mark Brown <broonie@linaro.org> |
| (cherry picked from commit b5f3d7af286a28e2fcc92debaba40844cb32bfb4) |
| Signed-off-by: Simon Horman <horms+renesas@verge.net.au> |
| --- |
| sound/soc/sh/rcar/scu.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/sound/soc/sh/rcar/scu.c b/sound/soc/sh/rcar/scu.c |
| index f4453e33a847..fa8fa15860b9 100644 |
| --- a/sound/soc/sh/rcar/scu.c |
| +++ b/sound/soc/sh/rcar/scu.c |
| @@ -68,7 +68,7 @@ static int rsnd_scu_set_route(struct rsnd_priv *priv, |
| return 0; |
| |
| id = rsnd_mod_id(mod); |
| - if (id < 0 || id > ARRAY_SIZE(routes)) |
| + if (id < 0 || id >= ARRAY_SIZE(routes)) |
| return -EIO; |
| |
| /* |
| -- |
| 1.8.5.rc3 |
| |
