media: tc358840: BUG_ON for overrunning array

In print_avi_infoframe, it allocates array buffer of 17 bytes.
It might run into a case to access array buffer at byte position 28.
in hdmi_infoframe_unpack when switch case value is SPD.

bug 200192413

Change-Id: I3624d471353f8c5b0ed317fc30e61beee7290439
Signed-off-by: Ahung Cheng <ahcheng@nvidia.com>
Reviewed-on: http://git-master/r/1176086
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Jihoon Bang <jbang@nvidia.com>

diff --git a/drivers/media/i2c/tc358840.c b/drivers/media/i2c/tc358840.c
index ab2b30da48c8078ad28c32e2cf37d61e53b3ebdd..bc3cebf6c6815fe3d2ad914c1b805d82984c6d8a 100644 (file)
--- a/drivers/media/i2c/tc358840.c
+++ b/drivers/media/i2c/tc358840.c
@@ -519,6 +519,8 @@ static void print_avi_infoframe(struct v4l2_subdev *sd)
 
        i2c_rd(sd, PK_AVI_0HEAD, buffer, HDMI_INFOFRAME_SIZE(AVI));
 
+       BUG_ON(buffer[0] != HDMI_INFOFRAME_TYPE_AVI);
+
        if (hdmi_infoframe_unpack(&frame, buffer) < 0) {
                v4l2_err(sd, "%s: unpack of AVI infoframe failed\n", __func__);
                return;