From: Mauro Carvalho Chehab Date: Sat, 26 Aug 2017 19:34:37 +0000 (-0400) Subject: media: qcom: don't go past the array X-Git-Tag: v4.14-rc6~35^2~141 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=6e893ca25e9ea87aeb5400af58518111e42582fe;p=platform%2Fkernel%2Flinux-rpi.git media: qcom: don't go past the array As reported by smatch: drivers/media/platform/qcom/camss-8x16/camss-vfe.c:1136 vfe_release_wm() error: buffer overflow 'vfe->wm_output_map' 7 <= 7 Signed-off-by: Mauro Carvalho Chehab --- diff --git a/drivers/media/platform/qcom/camss-8x16/camss-vfe.c b/drivers/media/platform/qcom/camss-8x16/camss-vfe.c index 94d635e..b21b3c2 100644 --- a/drivers/media/platform/qcom/camss-8x16/camss-vfe.c +++ b/drivers/media/platform/qcom/camss-8x16/camss-vfe.c @@ -1130,7 +1130,7 @@ static int vfe_reserve_wm(struct vfe_device *vfe, enum vfe_line_id line_id) static int vfe_release_wm(struct vfe_device *vfe, u8 wm) { - if (wm > ARRAY_SIZE(vfe->wm_output_map)) + if (wm >= ARRAY_SIZE(vfe->wm_output_map)) return -EINVAL; vfe->wm_output_map[wm] = VFE_LINE_NONE;