From: jsg <jsg@openbsd.org>
Date: Thu, 8 Feb 2024 00:00:16 +0000 (+0000)
Subject: fix off-by-one in bounds test
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=d2e03d4926cc65b7dc3b2dd23d1d3342b04c7b4b;p=openbsd

fix off-by-one in bounds test

found by "buffer overflow 'sc->sc_pins[i]->funcs' 10 <= 10" smatch error
ok miod@ kettenis@
---

diff --git a/sys/dev/fdt/sxipio.c b/sys/dev/fdt/sxipio.c
index 8f422da341a..d369d70e9be 100644
--- a/sys/dev/fdt/sxipio.c
+++ b/sys/dev/fdt/sxipio.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sxipio.c,v 1.18 2024/02/07 22:34:39 kettenis Exp $	*/
+/*	$OpenBSD: sxipio.c,v 1.19 2024/02/08 00:00:16 jsg Exp $	*/
 /*
  * Copyright (c) 2010 Miodrag Vallat.
  * Copyright (c) 2013 Artturi Alm
@@ -362,7 +362,7 @@ sxipio_pinctrl(uint32_t phandle, void *cookie)
 			if (strcmp(func, sc->sc_pins[i].funcs[j].name) == 0)
 				break;
 		}
-		if (j > nitems(sc->sc_pins[i].funcs))
+		if (j >= nitems(sc->sc_pins[i].funcs))
 			goto err;
 
 		group = sc->sc_pins[i].name[1] - 'A';