All of lore.kernel.org
 help / color / mirror / Atom feed
From: Karan Sanghavi <karansanghvi98@gmail.com>
To: Javier Carrasco <javier.carrasco.cruz@gmail.com>,
	Jonathan Cameron <jic23@kernel.org>,
	Lars-Peter Clausen <lars@metafoo.de>
Cc: linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org,
	Shuah Khan <skhan@linuxfoundation.org>,
	Karan Sanghavi <karansanghvi98@gmail.com>
Subject: [PATCH v2] iio: light: Add check for array bounds in veml6075_read_int_time_ms
Date: Mon, 3 Feb 2025 16:05:56 +0000	[thread overview]
Message-ID: <Z6DpZDJPDtiDzxDU@Emma> (raw)

The array contains only 5 elements, but the index calculated by
veml6075_read_int_time_index can range from 0 to 7,
which could lead to out-of-bounds access. The check prevents this issue.

Coverity Issue
CID 1574309: (#1 of 1): Out-of-bounds read (OVERRUN)
overrun-local: Overrunning array veml6075_it_ms of 5 4-byte
elements at element index 7 (byte offset 31) using
index int_index (which evaluates to 7)

Signed-off-by: Karan Sanghavi <karansanghvi98@gmail.com>
---
 drivers/iio/light/veml6075.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/light/veml6075.c b/drivers/iio/light/veml6075.c
index 05d4c0e9015d..21de193ca09d 100644
--- a/drivers/iio/light/veml6075.c
+++ b/drivers/iio/light/veml6075.c
@@ -210,8 +210,8 @@ static int veml6075_read_int_time_ms(struct veml6075_data *data, int *val)
 
 	guard(mutex)(&data->lock);
 	int_index = veml6075_read_int_time_index(data);
-	if (int_index < 0)
-		return int_index;
+	if (int_index < 0 || int_index >= ARRAY_SIZE(veml6075_it_ms))
+		return -EINVAL;
 
 	*val = veml6075_it_ms[int_index];
 
-- 
2.43.0


             reply	other threads:[~2025-02-03 16:06 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-02-03 16:05 Karan Sanghavi [this message]
2025-02-03 21:11 ` [PATCH v2] iio: light: Add check for array bounds in veml6075_read_int_time_ms Javier Carrasco

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Z6DpZDJPDtiDzxDU@Emma \
    --to=karansanghvi98@gmail.com \
    --cc=javier.carrasco.cruz@gmail.com \
    --cc=jic23@kernel.org \
    --cc=lars@metafoo.de \
    --cc=linux-iio@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=skhan@linuxfoundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.