Re: [patch] fbdev: off by one test (harmless)

[Tomi Valkeinen <tomi.valkeinen@ti.com>]

[-- Attachment #1: Type: text/plain, Size: 1240 bytes --]

On 15/01/15 14:26, Dan Carpenter wrote:
> On Thu, Jan 15, 2015 at 01:56:58PM +0200, Tomi Valkeinen wrote:
>>
>> Here's a fix for the cea_array size. Does it silence the static checker?
>>
> 
> No.
> 
>>  	for (i = specs->modedb_len + num; i < specs->modedb_len + num + svd_n; i++) {
>>  		int idx = svd[i - specs->modedb_len - num];
>> -		if (!idx || idx > 63) {
>> +		if (!idx || idx > 64) {
>>  			pr_warning("Reserved SVD code %d\n", idx);
>>  		} else if (idx > ARRAY_SIZE(cea_modes) || !cea_modes[idx].xres) {
>>  			pr_warning("Unimplemented SVD code %d\n", idx);
> 
> This static check ignores the value of "idx".
> 
> It is only looking at "idx > ARRAY_SIZE(cea_modes)" which is off by one
> and "idx" is used as an index in "!cea_modes[idx].xres".

Ah, right, I missed that in my patch. The check should obviously be
changed to:

if (idx >= ARRAY_SIZE(cea_modes)

But maybe it would be better to clean up the whole if statement to
remove the duplicate check. So in addition to increasing the cea_array size:

if (idx == 0 || idx >= ARRAY_SIZE(cea_modes)) {
	pr_warning("Reserved SVD code %d\n", idx);
} else if (!cea_modes[idx].xres) {
	pr_warning("Unimplemented SVD code %d\n", idx);

 Tomi



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]