ASoC: rcar: off by one in rsnd_scu_set_route()

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=b5f3d7af286a28e2fcc92debaba40844cb32bfb4
Commit:     b5f3d7af286a28e2fcc92debaba40844cb32bfb4
Parent:     6020779b118f6221e5d067bd1e6b44bab6fc0276
Author:     Dan Carpenter <dan.carpenter at oracle.com>
AuthorDate: Fri Nov 8 12:46:10 2013 +0300
Committer:  Mark Brown <broonie at linaro.org>
CommitDate: Tue Nov 19 19:07:07 2013 +0000

    ASoC: rcar: off by one in rsnd_scu_set_route()
    
    If "id == ARRAY_SIZE(routes)" then we read one space beyond the end of
    the routes[] array.
    
    Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
    Acked-by: Kuninori Morimoto <kuninori.morimoto.gx at renesas.com>
    Signed-off-by: Mark Brown <broonie at linaro.org>
---
 sound/soc/sh/rcar/scu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/sh/rcar/scu.c b/sound/soc/sh/rcar/scu.c
index 1ab1bce..5e46ef2 100644
--- a/sound/soc/sh/rcar/scu.c
+++ b/sound/soc/sh/rcar/scu.c
@@ -68,7 +68,7 @@ static int rsnd_scu_set_route(struct rsnd_priv *priv,
 		return 0;
 
 	id = rsnd_mod_id(mod);
-	if (id < 0 || id > ARRAY_SIZE(routes))
+	if (id < 0 || id >= ARRAY_SIZE(routes))
 		return -EIO;
 
 	/*