Commit 59d99deb authored by Alex Hung's avatar Alex Hung Committed by Alex Deucher
Browse files

drm/amd/display: Check index msg_id before read or write 



[WHAT]
msg_id is used as an array index and it cannot be a negative value, and
therefore cannot be equal to MOD_HDCP_MESSAGE_ID_INVALID (-1).

[HOW]
Check whether msg_id is valid before reading and setting.

This fixes 4 OVERRUN issues reported by Coverity.

Reviewed-by: default avatarRodrigo Siqueira <rodrigo.siqueira@amd.com>
Acked-by: default avatarWayne Lin <wayne.lin@amd.com>
Signed-off-by: default avatarAlex Hung <alex.hung@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
parent acce6479

drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c

+8 −0
Original line number Diff line number Diff line
@@ -156,6 +156,10 @@ static enum mod_hdcp_status read(struct mod_hdcp *hdcp, 
	uint32_t cur_size = 0;

	uint32_t data_offset = 0;



	if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) {

		return MOD_HDCP_STATUS_DDC_FAILURE;

	}



	if (is_dp_hdcp(hdcp)) {

		while (buf_len > 0) {

			cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);
@@ -215,6 +219,10 @@ static enum mod_hdcp_status write(struct mod_hdcp *hdcp, 
	uint32_t cur_size = 0;

	uint32_t data_offset = 0;



	if (msg_id == MOD_HDCP_MESSAGE_ID_INVALID) {

		return MOD_HDCP_STATUS_DDC_FAILURE;

	}



	if (is_dp_hdcp(hdcp)) {

		while (buf_len > 0) {

			cur_size = MIN(buf_len, HDCP_MAX_AUX_TRANSACTION_SIZE);