firmware: scmi: correct a validity check against power domain id

A power domain id on sandbox should be in the range from zero to
ARRAY_SIZE(scmi_pwdom) - 1. Correct the validity check logic.

Addresses-Coverity-ID: 467401 ("Out-of-bounds write")
Addresses-Coverity-ID: 467405 ("Out-of-bounds read")
Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>

diff --git a/drivers/firmware/scmi/sandbox-scmi_agent.c b/drivers/firmware/scmi/sandbox-scmi_agent.c
index 9f5f497e0a6c51179c4e6e923a825ea655f0e731..d131809626629bf4e140e273b790c3ae7b2393f6 100644 (file)
--- a/drivers/firmware/scmi/sandbox-scmi_agent.c
+++ b/drivers/firmware/scmi/sandbox-scmi_agent.c
@@ -576,7 +576,7 @@ static int sandbox_scmi_pwd_attribs(struct udevice *dev, struct scmi_msg *msg)
        domain_id = *(u32 *)msg->in_msg;
        out = (struct scmi_pwd_attrs_out *)msg->out_msg;
 
-       if (domain_id > ARRAY_SIZE(scmi_pwdom)) {
+       if (domain_id >= ARRAY_SIZE(scmi_pwdom)) {
                out->status = SCMI_NOT_FOUND;
 
                return 0;
@@ -613,7 +613,7 @@ static int sandbox_scmi_pwd_state_set(struct udevice *dev, struct scmi_msg *msg)
        in = (struct scmi_pwd_state_set_in *)msg->in_msg;
        status = (s32 *)msg->out_msg;
 
-       if (in->domain_id > ARRAY_SIZE(scmi_pwdom)) {
+       if (in->domain_id >= ARRAY_SIZE(scmi_pwdom)) {
                *status = SCMI_NOT_FOUND;
 
                return 0;
@@ -653,7 +653,7 @@ static int sandbox_scmi_pwd_state_get(struct udevice *dev, struct scmi_msg *msg)
        domain_id = *(u32 *)msg->in_msg;
        out = (struct scmi_pwd_state_get_out *)msg->out_msg;
 
-       if (domain_id > ARRAY_SIZE(scmi_pwdom)) {
+       if (domain_id >= ARRAY_SIZE(scmi_pwdom)) {
                out->status = SCMI_NOT_FOUND;
 
                return 0;
@@ -686,7 +686,7 @@ static int sandbox_scmi_pwd_name_get(struct udevice *dev, struct scmi_msg *msg)
        domain_id = *(u32 *)msg->in_msg;
        out = (struct scmi_pwd_name_get_out *)msg->out_msg;
 
-       if (domain_id > ARRAY_SIZE(scmi_pwdom)) {
+       if (domain_id >= ARRAY_SIZE(scmi_pwdom)) {
                out->status = SCMI_NOT_FOUND;
 
                return 0;