media: tc358840: BUG_ON for overrunning array
Ahung Cheng [Wed, 6 Jul 2016 05:16:59 +0000 (13:16 +0800)]
In print_avi_infoframe, it allocates array buffer of 17 bytes.
It might run into a case to access array buffer at byte position 28.
in hdmi_infoframe_unpack when switch case value is SPD.

bug 200192413

Change-Id: I3624d471353f8c5b0ed317fc30e61beee7290439
Signed-off-by: Ahung Cheng <ahcheng@nvidia.com>
Reviewed-on: http://git-master/r/1176086
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Jihoon Bang <jbang@nvidia.com>

drivers/media/i2c/tc358840.c

index ab2b30d..bc3cebf 100644 (file)
@@ -519,6 +519,8 @@ static void print_avi_infoframe(struct v4l2_subdev *sd)
 
        i2c_rd(sd, PK_AVI_0HEAD, buffer, HDMI_INFOFRAME_SIZE(AVI));
 
+       BUG_ON(buffer[0] != HDMI_INFOFRAME_TYPE_AVI);
+
        if (hdmi_infoframe_unpack(&frame, buffer) < 0) {
                v4l2_err(sd, "%s: unpack of AVI infoframe failed\n", __func__);
                return;