[PATCH 3/4] ASoC: Intel: bytcr_rt5651: Avoid OOB array read from the map name

[Takashi Iwai <tiwai@suse.de>]

Since the quirk bits can be passed arbitrarily via a module option, it
may lead to the OOB access over the map name string array.
Fix it by conditionally reading the array, instead.

Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 sound/soc/intel/boards/bytcr_rt5651.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
index 67c62844ca2a..53f64f01fb22 100644
--- a/sound/soc/intel/boards/bytcr_rt5651.c
+++ b/sound/soc/intel/boards/bytcr_rt5651.c
@@ -881,10 +881,15 @@ struct acpi_chan_package {   /* ACPICA seems to require 64 bit integers */
 	u64 mclock_value;    /* usually 25MHz (0x17d7940), ignored */
 };
 
+static const char *mic_name(int n)
+{
+	static const char * const mic_names[] = { "dmic", "in1", "in2", "in12" };
+	return n < ARRAY_SIZE(mic_names) ? mic_names[n] : "none";
+}
+
 static int snd_byt_rt5651_mc_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
-	static const char * const mic_name[] = { "dmic", "in1", "in2", "in12" };
 	struct snd_soc_acpi_mach *mach = dev_get_platdata(dev);
 	struct byt_rt5651_private *priv;
 	const char *platform_name;
@@ -1071,7 +1076,7 @@ static int snd_byt_rt5651_mc_probe(struct platform_device *pdev)
 	snprintf(byt_rt5651_components, sizeof(byt_rt5651_components),
 		 "cfg-spk:%s cfg-mic:%s%s",
 		 (byt_rt5651_quirk & BYT_RT5651_MONO_SPEAKER) ? "1" : "2",
-		 mic_name[BYT_RT5651_MAP(byt_rt5651_quirk)],
+		 mic_name(BYT_RT5651_MAP(byt_rt5651_quirk)),
 		 (byt_rt5651_quirk & BYT_RT5651_HP_LR_SWAPPED) ?
 			" cfg-hp:lrswap" : "");
 	byt_rt5651_card.components = byt_rt5651_components;
@@ -1080,7 +1085,7 @@ static int snd_byt_rt5651_mc_probe(struct platform_device *pdev)
 		 "bytcr-rt5651-%s-spk-%s-mic%s",
 		 (byt_rt5651_quirk & BYT_RT5651_MONO_SPEAKER) ?
 			"mono" : "stereo",
-		 mic_name[BYT_RT5651_MAP(byt_rt5651_quirk)],
+		 mic_name(BYT_RT5651_MAP(byt_rt5651_quirk)),
 		 (byt_rt5651_quirk & BYT_RT5651_HP_LR_SWAPPED) ?
 			"-hp-swapped" : "");
 	byt_rt5651_card.long_name = byt_rt5651_long_name;
-- 
2.49.0