media: atomisp: avoid ACPI package count underflow in gmin_cfg_get_dsm

gmin_cfg_get_dsm() iterates over ACPI _DSM package elements as
key/value pairs using obj->package.count - 1 as the loop bound.

If package.count is 0, the subtraction underflows and may lead
to out-of-bounds access.

Use i + 1 < obj->package.count instead.

Signed-off-by: Mohamad El Harake <mohamedharake2006@gmail.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>

diff --git a/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c b/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c
index ba61cc28fac1aa7e0536171981b674d9b1000c81..cca91c6d71a596594425a6401292a82bb4f8db12 100644 (file)
--- a/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_csi2_bridge.c
@@ -113,7 +113,7 @@ static char *gmin_cfg_get_dsm(struct acpi_device *adev, const char *key)
        if (!obj)
                return NULL;
 
-       for (i = 0; i < obj->package.count - 1; i += 2) {
+       for (i = 0; i + 1 < obj->package.count; i += 2) {
                key_el = &obj->package.elements[i + 0];
                val_el = &obj->package.elements[i + 1];