[PATCH 2/4] ASoC: Intel: bytcr_rt5640: Avoid OOB array read from the map name

[Takashi Iwai <tiwai@suse.de>]

Since the quirk bits can be passed arbitrarily via a module option, it
may lead to the OOB access over the map name string array.
Fix it by conditionally reading the array, instead.

Fixes: 063422ca2a9d ("ASoC: Intel: bytcr_rt5640: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 sound/soc/intel/boards/bytcr_rt5640.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index 6446cda0f857..1ba9caa272c0 100644
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -1676,10 +1676,15 @@ struct acpi_chan_package {   /* ACPICA seems to require 64 bit integers */
 	u64 mclock_value;    /* usually 25MHz (0x17d7940), ignored */
 };
 
+static const char *map_name(int n)
+{
+	static const char * const map_names[] = { "dmic1", "dmic2", "in1", "in3" };
+	return n < ARRAY_SIZE(map_names) ? map_names[n] : "none";
+}
+
 static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	static const char * const map_name[] = { "dmic1", "dmic2", "in1", "in3", "none" };
 	struct snd_soc_acpi_mach *mach = dev_get_platdata(dev);
 	__maybe_unused const char *spk_type;
 	const struct dmi_system_id *dmi_id;
@@ -1903,13 +1908,13 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
 
 	snprintf(byt_rt5640_components, sizeof(byt_rt5640_components),
 		 "cfg-spk:%s cfg-mic:%s aif:%d%s%s", cfg_spk,
-		 map_name[BYT_RT5640_MAP(byt_rt5640_quirk)], aif,
+		 map_name(BYT_RT5640_MAP(byt_rt5640_quirk)), aif,
 		 lineout_string, headset2_string);
 	byt_rt5640_card.components = byt_rt5640_components;
 #if !IS_ENABLED(CONFIG_SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES)
 	snprintf(byt_rt5640_long_name, sizeof(byt_rt5640_long_name),
 		 "bytcr-rt5640-%s-spk-%s-mic", spk_type,
-		 map_name[BYT_RT5640_MAP(byt_rt5640_quirk)]);
+		 map_name(BYT_RT5640_MAP(byt_rt5640_quirk)));
 	byt_rt5640_card.long_name = byt_rt5640_long_name;
 #endif
 
-- 
2.49.0