Input: pcf8574_keypad - fix off by one in pcf8574_kp_irq_handler()

If nextstate == ARRAY_SIZE(lp->btncode), then we read one past the end of
the array on the next line.

This fixes a smatch warning:
drivers/input/misc/pcf8574_keypad.c +74 pcf8574_kp_irq_handler(8)
	error: buffer overflow 'lp->btncode' 17 <= 17

Signed-off-by: Dan Carpenter <[email protected]>
Acked-by: Jean Delvare <[email protected]>
Signed-off-by: Dmitry Torokhov <[email protected]>

diff --git a/drivers/input/misc/pcf8574_keypad.c b/drivers/input/misc/pcf8574_keypad.c
index 5c3ac4e0b055837976624cbd3ef1873cc81d82c6..376e54df4763b1eadfd9eb6b20814ffa3671bb99 100644 (file)
--- a/drivers/input/misc/pcf8574_keypad.c
+++ b/drivers/input/misc/pcf8574_keypad.c
@@ -69,7 +69,7 @@ static irqreturn_t pcf8574_kp_irq_handler(int irq, void *dev_id)
        unsigned char nextstate = read_state(lp);
 
        if (lp->laststate != nextstate) {
-               int key_down = nextstate <= ARRAY_SIZE(lp->btncode);
+               int key_down = nextstate < ARRAY_SIZE(lp->btncode);
                unsigned short keycode = key_down ?
                        lp->btncode[nextstate] : lp->btncode[lp->laststate];