bluetooth: don't access outside array range

diff --git a/src/modules/bluetooth/module-bluetooth-device.c b/src/modules/bluetooth/module-bluetooth-device.c
index 4c1f1c3e7991fceac15e0eb01201ccabe6f49796..2c4f29c89589bc89d2c7140bfb7e78ec3837a486 100644 (file)
--- a/src/modules/bluetooth/module-bluetooth-device.c
+++ b/src/modules/bluetooth/module-bluetooth-device.c
@@ -448,8 +448,8 @@ static int setup_a2dp(struct userdata *u) {
             break;
         }
 
-    if ((unsigned) i >= PA_ELEMENTSOF(freq_table)) {
-        for (; i >= 0; i--) {
+    if ((unsigned) i == PA_ELEMENTSOF(freq_table)) {
+        for (--i; i >= 0; i--) {
             if (cap->frequency & freq_table[i].cap) {
                 u->sample_spec.rate = freq_table[i].rate;
                 cap->frequency = freq_table[i].cap;
@@ -463,6 +463,8 @@ static int setup_a2dp(struct userdata *u) {
         }
     }
 
+    pa_assert(i < PA_ELEMENTSOF(freq_table));
+
     if (cap->capability.configured)
         return 0;