ASoC: rcar: off by one in rsnd_scu_set_route()

Dan Carpenter · broonie · commit b5f3d7af286a · 2013-11-19T19:07:07.000Z
If "id == ARRAY_SIZE(routes)" then we read one space beyond the end of
the routes[] array.

Signed-off-by: Dan Carpenter &lt;dan.carpenter@oracle.com&gt;
Acked-by: Kuninori Morimoto &lt;kuninori.morimoto.gx@renesas.com&gt;
Signed-off-by: Mark Brown &lt;broonie@linaro.org&gt;
diff --git a/sound/soc/sh/rcar/scu.c b/sound/soc/sh/rcar/scu.c
@@ -68,7 +68,7 @@ static int rsnd_scu_set_route(struct rsnd_priv *priv,
 		return 0;
 
 	id = rsnd_mod_id(mod);
-	if (id < 0 || id > ARRAY_SIZE(routes))
+	if (id < 0 || id >= ARRAY_SIZE(routes))
 		return -EIO;
 
 	/*
