media: atomisp: Fix a buffer overflow in debug code

The "pad" variable is a user controlled string and we haven't properly
clamped it at this point so the debug code could print from beyond the
of the array.

Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>

diff --git a/drivers/staging/media/atomisp/pci/atomisp_subdev.c b/drivers/staging/media/atomisp/pci/atomisp_subdev.c
index 52b9fb1..dcc2dd9 100644 (file)
--- a/drivers/staging/media/atomisp/pci/atomisp_subdev.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_subdev.c
@@ -349,12 +349,20 @@ static int isp_subdev_get_selection(struct v4l2_subdev *sd,
        return 0;
 }
 
-static char *atomisp_pad_str[] = { "ATOMISP_SUBDEV_PAD_SINK",
-                                  "ATOMISP_SUBDEV_PAD_SOURCE_CAPTURE",
-                                  "ATOMISP_SUBDEV_PAD_SOURCE_VF",
-                                  "ATOMISP_SUBDEV_PAD_SOURCE_PREVIEW",
-                                  "ATOMISP_SUBDEV_PAD_SOURCE_VIDEO"
-                                };
+static const char *atomisp_pad_str(unsigned int pad)
+{
+       static const char *const pad_str[] = {
+               "ATOMISP_SUBDEV_PAD_SINK",
+               "ATOMISP_SUBDEV_PAD_SOURCE_CAPTURE",
+               "ATOMISP_SUBDEV_PAD_SOURCE_VF",
+               "ATOMISP_SUBDEV_PAD_SOURCE_PREVIEW",
+               "ATOMISP_SUBDEV_PAD_SOURCE_VIDEO",
+       };
+
+       if (pad >= ARRAY_SIZE(pad_str))
+               return "ATOMISP_INVALID_PAD";
+       return pad_str[pad];
+}
 
 int atomisp_subdev_set_selection(struct v4l2_subdev *sd,
                                 struct v4l2_subdev_pad_config *cfg,
@@ -378,7 +386,7 @@ int atomisp_subdev_set_selection(struct v4l2_subdev *sd,
 
        dev_dbg(isp->dev,
                "sel: pad %s tgt %s l %d t %d w %d h %d which %s f 0x%8.8x\n",
-               atomisp_pad_str[pad], target == V4L2_SEL_TGT_CROP
+               atomisp_pad_str(pad), target == V4L2_SEL_TGT_CROP
                ? "V4L2_SEL_TGT_CROP" : "V4L2_SEL_TGT_COMPOSE",
                r->left, r->top, r->width, r->height,
                which == V4L2_SUBDEV_FORMAT_TRY ? "V4L2_SUBDEV_FORMAT_TRY"
@@ -612,7 +620,7 @@ void atomisp_subdev_set_ffmt(struct v4l2_subdev *sd,
        enum atomisp_input_stream_id stream_id;
 
        dev_dbg(isp->dev, "ffmt: pad %s w %d h %d code 0x%8.8x which %s\n",
-               atomisp_pad_str[pad], ffmt->width, ffmt->height, ffmt->code,
+               atomisp_pad_str(pad), ffmt->width, ffmt->height, ffmt->code,
                which == V4L2_SUBDEV_FORMAT_TRY ? "V4L2_SUBDEV_FORMAT_TRY"
                : "V4L2_SUBDEV_FORMAT_ACTIVE");