Commit b5f3d7af authored Nov 08, 2013 by Dan Carpenter Committed by Mark Brown Nov 19, 2013

ASoC: rcar: off by one in rsnd_scu_set_route()



If "id == ARRAY_SIZE(routes)" then we read one space beyond the end of
the routes[] array.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Mark Brown <broonie@linaro.org>

parent 6020779b

sound/soc/sh/rcar/scu.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -68,7 +68,7 @@ static int rsnd_scu_set_route(struct rsnd_priv *priv,
		return 0;

		id = rsnd_mod_id(mod);
		if (id < 0 \|\| id > ARRAY_SIZE(routes))
		if (id < 0 \|\| id >= ARRAY_SIZE(routes))
		return -EIO;

		/*

Admin message