drivers: dac: dac_ad56xx: Fix channel range check

bwitherspoon · nashif · commit 97190d76ecc4 · 2024-07-09T15:31:58.000-04:00
An off by one error in the channel range check results in an out of
bound access to the channel lookup array.

Signed-off-by: Brett Witherspoon &lt;brett@witherspoon.engineering&gt;
diff --git a/drivers/dac/dac_ad56xx.c b/drivers/dac/dac_ad56xx.c
@@ -106,7 +106,7 @@ static int ad56xx_write_value(const struct device *dev, uint8_t channel, uint32_
 		return -EINVAL;
 	}
 
-	if (channel > config->channel_count) {
+	if (channel >= config->channel_count) {
 		LOG_ERR("invalid channel %i", channel);
 		return -EINVAL;
 	}

Original file line number	Diff line number	Diff line change
`@@ -106,7 +106,7 @@ static int ad56xx_write_value(const struct device *dev, uint8_t channel, uint32_`
`106`	`106`	`return -EINVAL;`
`107`	`107`	`}`
`108`	`108`
`109`		`- if (channel > config->channel_count) {`
	`109`	`+ if (channel >= config->channel_count) {`
`110`	`110`	`LOG_ERR("invalid channel %i", channel);`
`111`	`111`	`return -EINVAL;`
`112`	`112`	`}`