[PATCH 1/1] sbi_domain: correct loops in sanitize_domain()

[Heinrich Schuchardt]

If sbi_domain_used_memregions() were to return 0, (count - 1) would
evaluate to UINT_MAX and a buffer overrun would occur.

We don't expect this to happen. But we should be prudent in our code.

Addresses-Coverity-ID: 1680796 ("Illegal address computation")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt at canonical.com>
---
 lib/sbi/sbi_domain.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c
index 42fe5632..73686da3 100644
--- a/lib/sbi/sbi_domain.c
+++ b/lib/sbi/sbi_domain.c
@@ -493,7 +493,7 @@ static int sanitize_domain(struct sbi_domain *dom)
 	}
 
 	/* Sort the memory regions */
-	for (i = 0; i < (count - 1); i++) {
+	for (i = 0; i + 1 < count; i++) {
 		reg = &dom->regions[i];
 		for (j = i + 1; j < count; j++) {
 			reg1 = &dom->regions[j];
@@ -506,7 +506,7 @@ static int sanitize_domain(struct sbi_domain *dom)
 	}
 
 	/* Remove covered regions */
-	for (i = 0; i < (count - 1);) {
+	for (i = 0; i + 1 < count;) {
 		is_covered = false;
 		reg = &dom->regions[i];
 
-- 
2.53.0