pinctl: mediatek: add bounds check on number of base addresses

Add a bounds check on the number of base addresses to prevent
out-of-bounds access to the priv->base array.

Reviewed-by: Macpaul Lin <macpaul.lin@mediatek.com>
Link: https://patch.msgid.link/20260209-mtk-pinctl-mt8189-v1-1-a7a3069eda6c@baylibre.com
Signed-off-by: David Lechner <dlechner@baylibre.com>

diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
index e991e03ea41faf9e8fb86e9e2d357f79b2fc01e7..d152e2166348d361b9b20c6a1e16f281cecbe278 100644 (file)
--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c
@@ -856,6 +856,9 @@ int mtk_pinctrl_common_probe(struct udevice *dev,
        if (!base_calc)
                nbase_names = 1;
 
+       if (nbase_names > MAX_BASE_CALC)
+               return -ENOSPC;
+
        for (i = 0; i < nbase_names; i++) {
                if (soc->base_names)
                        addr = dev_read_addr_name(dev, soc->base_names[i]);