da9052-battery: Avoid out-of-range array access
authorNickolai Zeldovich <nickolai@csail.mit.edu>
Sat, 5 Jan 2013 19:14:51 +0000 (14:14 -0500)
committerAnton Vorontsov <anton@enomsg.org>
Sun, 6 Jan 2013 22:34:26 +0000 (14:34 -0800)
Avoid accessing vc_tbl_ref[3], which is one past the end of that array, in
da9052_determine_vc_tbl_index(), by adjusting the loop bound.

(Hint: there is 'i + 1' inside the loop.)

Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Anton Vorontsov <anton@enomsg.org>
drivers/power/da9052-battery.c

index 3c5c2e459d73c73b5f41493da8d383c74d606b3a..08193feb3b088bc7ae7d43134e6a12e7e2f75da9 100644 (file)
@@ -337,7 +337,7 @@ static unsigned char da9052_determine_vc_tbl_index(unsigned char adc_temp)
        if (adc_temp > vc_tbl_ref[DA9052_VC_TBL_REF_SZ - 1])
                return DA9052_VC_TBL_REF_SZ - 1;
 
-       for (i = 0; i < DA9052_VC_TBL_REF_SZ; i++) {
+       for (i = 0; i < DA9052_VC_TBL_REF_SZ - 1; i++) {
                if ((adc_temp > vc_tbl_ref[i]) &&
                    (adc_temp <= DA9052_MEAN(vc_tbl_ref[i], vc_tbl_ref[i + 1])))
                                return i;