* [patch] staging: bcm2835-audio: off by one in snd_bcm2835_playback_open_generic()
@ 2017-02-07 13:17 Dan Carpenter
0 siblings, 0 replies; only message in thread
From: Dan Carpenter @ 2017-02-07 13:17 UTC (permalink / raw)
To: kernel-janitors
The > should be >= otherwise we write beyond the end of the array when
we do:
chip->alsa_stream[idx] = alsa_stream;
Fixes: 23b028c871e1 ("staging: bcm2835-audio: initial staging submission")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/staging/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/bcm2835-audio/bcm2835-pcm.c
index d2d9f9b6a09b..014bf7ab69f4 100644
--- a/drivers/staging/bcm2835-audio/bcm2835-pcm.c
+++ b/drivers/staging/bcm2835-audio/bcm2835-pcm.c
@@ -130,7 +130,7 @@ static int snd_bcm2835_playback_open_generic(
err = -EBUSY;
goto out;
}
- if (idx > MAX_SUBSTREAMS) {
+ if (idx >= MAX_SUBSTREAMS) {
audio_error
("substream(%d) device doesn't exist max(%d) substreams allowed\n",
idx, MAX_SUBSTREAMS);
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2017-02-07 13:17 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-07 13:17 [patch] staging: bcm2835-audio: off by one in snd_bcm2835_playback_open_generic() Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.