From 2471ec5895b2e3eeb55f4386a793123c8a5bf88a Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 29 Mar 2012 21:52:20 +0300 Subject: [PATCH] Staging: rts5139: a couple off by one fixes Inside the array we check ms_start_idx[seg_no + 1] so on the last round through we end up going past the end of the array. Also if we don't break out of the loop early then we are beyond the end of the array there as well. With this change, if we don't find what we are looking for, we end on the last element of the array. Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rts5139/ms.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/staging/rts5139/ms.c b/drivers/staging/rts5139/ms.c index b0e9071..02aad2d 100644 --- a/drivers/staging/rts5139/ms.c +++ b/drivers/staging/rts5139/ms.c @@ -3864,7 +3864,7 @@ static int ms_rw_multi_sector(struct scsi_cmnd *srb, struct rts51x_chip *chip, log_blk = (u16) (start_sector >> ms_card->block_shift); start_page = (u8) (start_sector & ms_card->page_off); - for (seg_no = 0; seg_no < sizeof(ms_start_idx) / 2; seg_no++) { + for (seg_no = 0; seg_no < ARRAY_SIZE(ms_start_idx) - 1; seg_no++) { if (log_blk < ms_start_idx[seg_no + 1]) break; } @@ -4020,7 +4020,8 @@ static int ms_rw_multi_sector(struct scsi_cmnd *srb, struct rts51x_chip *chip, log_blk++; - for (seg_no = 0; seg_no < sizeof(ms_start_idx) / 2; seg_no++) { + for (seg_no = 0; seg_no < ARRAY_SIZE(ms_start_idx) - 1; + seg_no++) { if (log_blk < ms_start_idx[seg_no + 1]) break; } -- 2.7.4