[alsa-devel] [patch] ASoC: rcar: off by one in rsnd_scu_set_route()
Kuninori Morimoto
kuninori.morimoto.gx at renesas.com
Mon Nov 11 01:13:14 CET 2013
Hi
> If "id == ARRAY_SIZE(routes)" then we read one space beyond the end of
> the routes[] array.
>
> Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
>
> diff --git a/sound/soc/sh/rcar/scu.c b/sound/soc/sh/rcar/scu.c
> index 1ab1bce..5e46ef2 100644
> --- a/sound/soc/sh/rcar/scu.c
> +++ b/sound/soc/sh/rcar/scu.c
Nice catch
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx at renesas.com>
> @@ -68,7 +68,7 @@ static int rsnd_scu_set_route(struct rsnd_priv *priv,
> return 0;
>
> id = rsnd_mod_id(mod);
> - if (id < 0 || id > ARRAY_SIZE(routes))
> + if (id < 0 || id >= ARRAY_SIZE(routes))
> return -EIO;
>
> /*
> _______________________________________________
> Alsa-devel mailing list
> Alsa-devel at alsa-project.org
> http://mailman.alsa-project.org/mailman/listinfo/alsa-devel
Best regards
---
Kuninori Morimoto
More information about the Alsa-devel
mailing list