media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()

It's possible for cp_read() and hdmi_read() to return -EIO. Those
values are further used as indexes for accessing arrays.

Fix that by checking return values where it's needed.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: a89bcd4c6c20 ("[media] adv7842: add new video decoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>

diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c
index 331c5171d1ab2baf2d806c3fa7ab38621b0039c6..21c3d3682e0b453994be5e21b8e97452b1b2831a 100644 (file)
--- a/drivers/media/i2c/adv7842.c
+++ b/drivers/media/i2c/adv7842.c
@@ -2699,6 +2699,7 @@ static int adv7842_cp_log_status(struct v4l2_subdev *sd)
        /* CP block */
        struct adv7842_state *state = to_state(sd);
        struct v4l2_dv_timings timings;
+       int temp;
        u8 reg_io_0x02 = io_read(sd, 0x02);
        u8 reg_io_0x21 = io_read(sd, 0x21);
        u8 reg_rep_0x77 = rep_read(sd, 0x77);
@@ -2821,8 +2822,9 @@ static int adv7842_cp_log_status(struct v4l2_subdev *sd)
                  (((reg_io_0x02 >> 2) & 0x01) ^ (reg_io_0x02 & 0x01)) ?
                        "(16-235)" : "(0-255)",
                  (reg_io_0x02 & 0x08) ? "enabled" : "disabled");
+       temp = cp_read(sd, 0xf4) >> 4;
        v4l2_info(sd, "Color space conversion: %s\n",
-                 csc_coeff_sel_rb[cp_read(sd, 0xf4) >> 4]);
+                 temp < 0 ? "" : csc_coeff_sel_rb[temp]);
 
        if (!is_digital_input(sd))
                return 0;
@@ -2852,8 +2854,9 @@ static int adv7842_cp_log_status(struct v4l2_subdev *sd)
                        hdmi_read(sd, 0x5f));
        v4l2_info(sd, "AV Mute: %s\n",
                        (hdmi_read(sd, 0x04) & 0x40) ? "on" : "off");
+       temp = hdmi_read(sd, 0x0b) >> 6;
        v4l2_info(sd, "Deep color mode: %s\n",
-                       deep_color_mode_txt[hdmi_read(sd, 0x0b) >> 6]);
+                       temp < 0 ? "" : deep_color_mode_txt[temp]);
 
        adv7842_log_infoframes(sd);