Re: [PATCH] cxd2820r: fix possible out-of-array lookup

[Malcolm Priestley <tvboxspy@gmail.com>]

On Sat, 2011-07-23 at 01:47 +0200, HoP wrote:
> 2011/7/23 Antti Palosaari <crope@iki.fi>:
> > On 07/23/2011 02:31 AM, Antti Palosaari wrote:
> >>
> >> On 07/23/2011 02:01 AM, HoP wrote:
> >>>
> >>> 2011/7/23 Antti Palosaari<crope@iki.fi>:
> >>>>
> >>>> But now I see what you mean. msg2[1] is set as garbage fields in case of
> >>>> incoming msg len is 1. True, but it does not harm since it is not
> >>>> used in
> >>>> that case.
> >>>
> >>> In case of write, cxd2820r_tuner_i2c_xfer() gets msg[] parameter
> >>> with only one element, true? If so, then my patch is correct.
> >>
> >> Yes it is true but nonsense. It is also wrong to make always msg2 as two
> >> element array too, but those are just simpler and generates most likely
> >> some code less. Could you see it can cause problem in some case?
> >
> > Now I thought it more, could it crash if it point out of memory area?
Arrays are not fussy they will read anything, just don't poke them :-)
> 
> I see you finally understood what I wanted to do :-)
> 
> I'm surprised that it not crashed already. I thought I have to missed something.

It does not crash because num is constant throughout, when the number of
messages is one the second element isn't transferred.