From: Karan Sanghavi <karansanghvi98@gmail.com>
To: Javier Carrasco <javier.carrasco.cruz@gmail.com>,
Jonathan Cameron <jic23@kernel.org>,
Lars-Peter Clausen <lars@metafoo.de>
Cc: linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org,
Shuah Khan <skhan@linuxfoundation.org>,
Karan Sanghavi <karansanghvi98@gmail.com>
Subject: [PATCH v2] iio: light: Add check for array bounds in veml6075_read_int_time_ms
Date: Mon, 3 Feb 2025 16:05:56 +0000 [thread overview]
Message-ID: <Z6DpZDJPDtiDzxDU@Emma> (raw)
The array contains only 5 elements, but the index calculated by
veml6075_read_int_time_index can range from 0 to 7,
which could lead to out-of-bounds access. The check prevents this issue.
Coverity Issue
CID 1574309: (#1 of 1): Out-of-bounds read (OVERRUN)
overrun-local: Overrunning array veml6075_it_ms of 5 4-byte
elements at element index 7 (byte offset 31) using
index int_index (which evaluates to 7)
Signed-off-by: Karan Sanghavi <karansanghvi98@gmail.com>
---
drivers/iio/light/veml6075.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/light/veml6075.c b/drivers/iio/light/veml6075.c
index 05d4c0e9015d..21de193ca09d 100644
--- a/drivers/iio/light/veml6075.c
+++ b/drivers/iio/light/veml6075.c
@@ -210,8 +210,8 @@ static int veml6075_read_int_time_ms(struct veml6075_data *data, int *val)
guard(mutex)(&data->lock);
int_index = veml6075_read_int_time_index(data);
- if (int_index < 0)
- return int_index;
+ if (int_index < 0 || int_index >= ARRAY_SIZE(veml6075_it_ms))
+ return -EINVAL;
*val = veml6075_it_ms[int_index];
--
2.43.0
next reply other threads:[~2025-02-03 16:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-03 16:05 Karan Sanghavi [this message]
2025-02-03 21:11 ` [PATCH v2] iio: light: Add check for array bounds in veml6075_read_int_time_ms Javier Carrasco
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Z6DpZDJPDtiDzxDU@Emma \
--to=karansanghvi98@gmail.com \
--cc=javier.carrasco.cruz@gmail.com \
--cc=jic23@kernel.org \
--cc=lars@metafoo.de \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=skhan@linuxfoundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.