[PATCH 1/4] ASoC: Intel: bytcht_es8316: Avoid OOB array read from the map name

[Takashi Iwai <tiwai@suse.de>]

Since the quirk bits can be passed arbitrarily via a module option, it
may lead to the OOB access over the map name string array.
Fix it by conditionally reading the array, instead.

Fixes: 249d2fc9e55c ("ASoC: Intel: bytcht_es8316: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 sound/soc/intel/boards/bytcht_es8316.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
index 62594e7966ab..808142250ca1 100644
--- a/sound/soc/intel/boards/bytcht_es8316.c
+++ b/sound/soc/intel/boards/bytcht_es8316.c
@@ -518,10 +518,15 @@ static int byt_cht_es8316_get_quirks_from_dsm(struct byt_cht_es8316_private *pri
 	return 0;
 }
 
+static const char *mic_name(int n)
+{
+	static const char * const mic_names[] = { "in1", "in2" };
+	return n < ARRAY_SIZE(mic_names) ? mic_names[n] : "none";
+}
+
 static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	static const char * const mic_name[] = { "in1", "in2" };
 	struct snd_soc_acpi_mach *mach = dev_get_platdata(dev);
 	struct property_entry props[MAX_NO_PROPS] = {};
 	struct byt_cht_es8316_private *priv;
@@ -648,12 +653,12 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev)
 	snprintf(components_string, sizeof(components_string),
 		 "cfg-spk:%s cfg-mic:%s",
 		 (quirk & BYT_CHT_ES8316_MONO_SPEAKER) ? "1" : "2",
-		 mic_name[BYT_CHT_ES8316_MAP(quirk)]);
+		 mic_name(BYT_CHT_ES8316_MAP(quirk)));
 	byt_cht_es8316_card.components = components_string;
 #if !IS_ENABLED(CONFIG_SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES)
 	snprintf(long_name, sizeof(long_name), "bytcht-es8316-%s-spk-%s-mic",
 		 (quirk & BYT_CHT_ES8316_MONO_SPEAKER) ? "mono" : "stereo",
-		 mic_name[BYT_CHT_ES8316_MAP(quirk)]);
+		 mic_name(BYT_CHT_ES8316_MAP(quirk)));
 	byt_cht_es8316_card.long_name = long_name;
 #endif
 
-- 
2.49.0