From: Nickolai Zeldovich Date: Sat, 5 Jan 2013 19:14:51 +0000 (-0500) Subject: da9052-battery: Avoid out-of-range array access X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=c4f3422630464d231c14c8b9e585c23fcfe3436c;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git da9052-battery: Avoid out-of-range array access Avoid accessing vc_tbl_ref[3], which is one past the end of that array, in da9052_determine_vc_tbl_index(), by adjusting the loop bound. (Hint: there is 'i + 1' inside the loop.) Signed-off-by: Nickolai Zeldovich Signed-off-by: Anton Vorontsov --- diff --git a/drivers/power/da9052-battery.c b/drivers/power/da9052-battery.c index 3c5c2e459d73..08193feb3b08 100644 --- a/drivers/power/da9052-battery.c +++ b/drivers/power/da9052-battery.c @@ -337,7 +337,7 @@ static unsigned char da9052_determine_vc_tbl_index(unsigned char adc_temp) if (adc_temp > vc_tbl_ref[DA9052_VC_TBL_REF_SZ - 1]) return DA9052_VC_TBL_REF_SZ - 1; - for (i = 0; i < DA9052_VC_TBL_REF_SZ; i++) { + for (i = 0; i < DA9052_VC_TBL_REF_SZ - 1; i++) { if ((adc_temp > vc_tbl_ref[i]) && (adc_temp <= DA9052_MEAN(vc_tbl_ref[i], vc_tbl_ref[i + 1]))) return i;