From daf07215e8c4aed16af81e1615396f5502040c1f Mon Sep 17 00:00:00 2001 From: Rasmus Villemoes Date: Fri, 24 Mar 2023 08:55:19 +0100 Subject: stm32mp: fix various array bounds checks In all these cases, the index on the LHS is immediately afterwards used to access the array appearing in the ARRAY_SIZE() on the RHS - so if that index is equal to the array size, we'll access one-past-the-end of the array. Signed-off-by: Rasmus Villemoes Reviewed-by: Patrice Chotard Reviewed-by: Patrick Delaunay --- board/st/stm32mp1/stm32mp1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'board/st/stm32mp1/stm32mp1.c') diff --git a/board/st/stm32mp1/stm32mp1.c b/board/st/stm32mp1/stm32mp1.c index ca8f0255ae0..1a1b1844c8c 100644 --- a/board/st/stm32mp1/stm32mp1.c +++ b/board/st/stm32mp1/stm32mp1.c @@ -872,7 +872,7 @@ int mmc_get_boot(void) STM32_SDMMC3_BASE }; - if (instance > ARRAY_SIZE(sdmmc_addr)) + if (instance >= ARRAY_SIZE(sdmmc_addr)) return 0; /* search associated sdmmc node in devicetree */ -- cgit v1.2.3