[PATCH 4/4] ASoC: Intel: bytcr_wm5102: Avoid OOB array read from the map name

[Takashi Iwai <tiwai@suse.de>]

Since the quirk bits can be passed arbitrarily via a module option, it
may lead to the OOB access over the map name string array.
Fix it by conditionally reading the array, instead.

Fixes: c556d202bef1 ("ASoC: Intel: bytcr_wm5102: Add BYT_WM5102_OUT_MAP quirk")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 sound/soc/intel/boards/bytcr_wm5102.c | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/sound/soc/intel/boards/bytcr_wm5102.c b/sound/soc/intel/boards/bytcr_wm5102.c
index a6dfbcfdf74e..15a7302a1753 100644
--- a/sound/soc/intel/boards/bytcr_wm5102.c
+++ b/sound/soc/intel/boards/bytcr_wm5102.c
@@ -514,11 +514,26 @@ static struct snd_soc_card byt_wm5102_card = {
 
 static char byt_wm5102_components[64]; /* = "cfg-spk:* cfg-int-mic:* cfg-hs-mic:* ..." */
 
+static const char *out_map_name(int n)
+{
+	static const char * const map_names[] = { "spk", "hpout2" };
+	return n < ARRAY_SIZE(map_names) ? map_names[n] : "none";
+}
+
+static const char *intmic_map_name(int n)
+{
+	static const char * const map_names[] = { "in3l", "in1l" };
+	return n < ARRAY_SIZE(map_names) ? map_names[n] : "none";
+}
+
+static const char *hsmic_map_name(int n)
+{
+	static const char * const map_names[] = { "in1l", "in2l" };
+	return n < ARRAY_SIZE(map_names) ? map_names[n] : "none";
+}
+
 static int snd_byt_wm5102_mc_probe(struct platform_device *pdev)
 {
-	static const char * const out_map_name[] = { "spk", "hpout2" };
-	static const char * const intmic_map_name[] = { "in3l", "in1l" };
-	static const char * const hsmic_map_name[] = { "in1l", "in2l" };
 	char codec_name[SND_ACPI_I2C_ID_LEN];
 	struct device *dev = &pdev->dev;
 	struct byt_wm5102_private *priv;
@@ -594,9 +609,9 @@ static int snd_byt_wm5102_mc_probe(struct platform_device *pdev)
 
 	snprintf(byt_wm5102_components, sizeof(byt_wm5102_components),
 		 "cfg-spk:%s cfg-intmic:%s cfg-hsmic:%s",
-		 out_map_name[FIELD_GET(BYT_WM5102_OUT_MAP, quirk)],
-		 intmic_map_name[FIELD_GET(BYT_WM5102_IN_MAP, quirk)],
-		 hsmic_map_name[FIELD_GET(BYT_WM5102_IN_MAP, quirk)]);
+		 out_map_name(FIELD_GET(BYT_WM5102_OUT_MAP, quirk)),
+		 intmic_map_name(FIELD_GET(BYT_WM5102_IN_MAP, quirk)),
+		 hsmic_map_name(FIELD_GET(BYT_WM5102_IN_MAP, quirk)));
 	byt_wm5102_card.components = byt_wm5102_components;
 
 	/* find index of codec dai */
-- 
2.49.0