media: mt9v111: avoid going past the buffer

As warned by smatch:
	drivers/media/i2c/mt9v111.c:854 mt9v111_enum_frame_size() error: buffer overflow 'mt9v111_frame_sizes' 5 <= 5
	drivers/media/i2c/mt9v111.c:855 mt9v111_enum_frame_size() error: buffer overflow 'mt9v111_frame_sizes' 5 <= 5
	drivers/media/i2c/mt9v111.c:856 mt9v111_enum_frame_size() error: buffer overflow 'mt9v111_frame_sizes' 5 <= 5
	drivers/media/i2c/mt9v111.c:857 mt9v111_enum_frame_size() error: buffer overflow 'mt9v111_frame_sizes' 5 <= 5

Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>

diff --git a/drivers/media/i2c/mt9v111.c b/drivers/media/i2c/mt9v111.c
index 58d5f2224bff38fe7f6af2d8b49550f3a267378a..70fad09404355859078f154b49cee0851e6e917f 100644 (file)
--- a/drivers/media/i2c/mt9v111.c
+++ b/drivers/media/i2c/mt9v111.c
@@ -848,7 +848,7 @@ static int mt9v111_enum_frame_size(struct v4l2_subdev *subdev,
                                   struct v4l2_subdev_pad_config *cfg,
                                   struct v4l2_subdev_frame_size_enum *fse)
 {
-       if (fse->pad || fse->index > ARRAY_SIZE(mt9v111_frame_sizes))
+       if (fse->pad || fse->index >= ARRAY_SIZE(mt9v111_frame_sizes))
                return -EINVAL;
 
        fse->min_width = mt9v111_frame_sizes[fse->index].width;