[PATCH] fix array overrun in drivers/char/mwave/mwavedd.c

this fixes coverity id #489.

Since the last element in the array is always ARRAY_SIZE-1 we have to check
for ipcnum >= ARRAY_SIZE()

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c
index 8666171..d3ba2f8 100644 (file)
--- a/drivers/char/mwave/mwavedd.c
+++ b/drivers/char/mwave/mwavedd.c
@@ -271,7 +271,7 @@ static int mwave_ioctl(struct inode *inode, struct file *file,
                                ipcnum,
                                pDrvData->IPCs[ipcnum].usIntCount);
        
                                ipcnum,
                                pDrvData->IPCs[ipcnum].usIntCount);
        

-                       if (ipcnum > ARRAY_SIZE(pDrvData->IPCs)) {
+                       if (ipcnum >= ARRAY_SIZE(pDrvData->IPCs)) {

                                PRINTK_ERROR(KERN_ERR_MWAVE
                                                "mwavedd::mwave_ioctl:"
                                                " IOCTL_MW_REGISTER_IPC:"
                                PRINTK_ERROR(KERN_ERR_MWAVE
                                                "mwavedd::mwave_ioctl:"
                                                " IOCTL_MW_REGISTER_IPC:"