Explorar el Código

[ARM] Off-by-one in arch/arm/common/icst*

hi,

a quick find -iname \*.[ch] | xargs grep "> ARRAY_SIZE(", revealed
these in the icst drivers.
If i == ARRAY_SIZE, we get past the idx2s array.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Eric Sesterhenn hace 18 años
padre
commit
d1d8f7dec1
Se han modificado 2 ficheros con 4 adiciones y 4 borrados
  1. 2 2
      arch/arm/common/icst307.c
  2. 2 2
      arch/arm/common/icst525.c

+ 2 - 2
arch/arm/common/icst307.c

@@ -57,7 +57,7 @@ icst307_khz_to_vco(const struct icst307_params *p, unsigned long freq)
 			break;
 	} while (i < ARRAY_SIZE(idx2s));
 
-	if (i > ARRAY_SIZE(idx2s))
+	if (i >= ARRAY_SIZE(idx2s))
 		return vco;
 
 	vco.s = idx2s[i];
@@ -119,7 +119,7 @@ icst307_ps_to_vco(const struct icst307_params *p, unsigned long period)
 			break;
 	} while (i < ARRAY_SIZE(idx2s));
 
-	if (i > ARRAY_SIZE(idx2s))
+	if (i >= ARRAY_SIZE(idx2s))
 		return vco;
 
 	vco.s = idx2s[i];

+ 2 - 2
arch/arm/common/icst525.c

@@ -55,7 +55,7 @@ icst525_khz_to_vco(const struct icst525_params *p, unsigned long freq)
 			break;
 	} while (i < ARRAY_SIZE(idx2s));
 
-	if (i > ARRAY_SIZE(idx2s))
+	if (i >= ARRAY_SIZE(idx2s))
 		return vco;
 
 	vco.s = idx2s[i];
@@ -118,7 +118,7 @@ icst525_ps_to_vco(const struct icst525_params *p, unsigned long period)
 			break;
 	} while (i < ARRAY_SIZE(idx2s));
 
-	if (i > ARRAY_SIZE(idx2s))
+	if (i >= ARRAY_SIZE(idx2s))
 		return vco;
 
 	vco.s = idx2s[i];