media: qcom: don't go past the array

mchehab · mchehab · commit 6e893ca25e9e · 2017-08-26T15:34:37.000-04:00
As reported by smatch:

	drivers/media/platform/qcom/camss-8x16/camss-vfe.c:1136 vfe_release_wm() error: buffer overflow 'vfe-&gt;wm_output_map' 7 &lt;= 7

Signed-off-by: Mauro Carvalho Chehab &lt;mchehab@s-opensource.com&gt;
diff --git a/drivers/media/platform/qcom/camss-8x16/camss-vfe.c b/drivers/media/platform/qcom/camss-8x16/camss-vfe.c
@@ -1130,7 +1130,7 @@ static int vfe_reserve_wm(struct vfe_device *vfe, enum vfe_line_id line_id)
 
 static int vfe_release_wm(struct vfe_device *vfe, u8 wm)
 {
-	if (wm > ARRAY_SIZE(vfe->wm_output_map))
+	if (wm >= ARRAY_SIZE(vfe->wm_output_map))
 		return -EINVAL;
 
 	vfe->wm_output_map[wm] = VFE_LINE_NONE;

Original file line number	Diff line number	Diff line change
`@@ -1130,7 +1130,7 @@ static int vfe_reserve_wm(struct vfe_device *vfe, enum vfe_line_id line_id)`
`1130`	`1130`
`1131`	`1131`	`static int vfe_release_wm(struct vfe_device *vfe, u8 wm)`
`1132`	`1132`	`{`
`1133`		`- if (wm > ARRAY_SIZE(vfe->wm_output_map))`
	`1133`	`+ if (wm >= ARRAY_SIZE(vfe->wm_output_map))`
`1134`	`1134`	`return -EINVAL;`
`1135`	`1135`
`1136`	`1136`	`vfe->wm_output_map[wm] = VFE_LINE_NONE;`