Commit b5f3d7af authored by Dan Carpenter's avatar Dan Carpenter Committed by Mark Brown

ASoC: rcar: off by one in rsnd_scu_set_route()

If "id == ARRAY_SIZE(routes)" then we read one space beyond the end of
the routes[] array.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarKuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: default avatarMark Brown <broonie@linaro.org>
parent 6020779b
...@@ -68,7 +68,7 @@ static int rsnd_scu_set_route(struct rsnd_priv *priv, ...@@ -68,7 +68,7 @@ static int rsnd_scu_set_route(struct rsnd_priv *priv,
return 0; return 0;
id = rsnd_mod_id(mod); id = rsnd_mod_id(mod);
if (id < 0 || id > ARRAY_SIZE(routes)) if (id < 0 || id >= ARRAY_SIZE(routes))
return -EIO; return -EIO;
/* /*
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment