[PATCH 24/45] drm/amd/display: Check msg_id before processing transcation

[Tom Chung]

From: Alex Hung <alex.h...@amd.com>

[WHY & HOW]
HDCP_MESSAGE_ID_INVALID (-1) is not a valid msg_id nor is it a valid
array index, and it needs checking before used.

This fixes 4 OVERRUN issues reported by Coverity.

Reviewed-by: Harry Wentland <harry.wentl...@amd.com>
Acked-by: Tom Chung <chiahsuan.ch...@amd.com>
Signed-off-by: Alex Hung <alex.h...@amd.com>
---
 drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c 
b/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c
index 076a829c2378..1313a7c5d87b 100644
--- a/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c
+++ b/drivers/gpu/drm/amd/display/dc/hdcp/hdcp_msg.c
@@ -128,13 +128,21 @@ static bool hdmi_14_process_transaction(
        const uint8_t hdcp_i2c_addr_link_primary = 0x3a; /* 0x74 >> 1*/
        const uint8_t hdcp_i2c_addr_link_secondary = 0x3b; /* 0x76 >> 1*/
        struct i2c_command i2c_command;
-       uint8_t offset = hdcp_i2c_offsets[message_info->msg_id];
+       uint8_t offset;
        struct i2c_payload i2c_payloads[] = {
-               { true, 0, 1, &offset },
+               { true, 0, 1, 0 },
                /* actual hdcp payload, will be filled later, zeroed for now*/
                { 0 }
        };
 
+       if (message_info->msg_id == HDCP_MESSAGE_ID_INVALID) {
+               DC_LOG_ERROR("%s: Invalid message_info msg_id - %d\n", 
__func__, message_info->msg_id);
+               return false;
+       }
+
+       offset = hdcp_i2c_offsets[message_info->msg_id];
+       i2c_payloads[0].data = &offset;
+
        switch (message_info->link) {
        case HDCP_LINK_SECONDARY:
                i2c_payloads[0].address = hdcp_i2c_addr_link_secondary;
@@ -308,6 +316,11 @@ static bool dp_11_process_transaction(
        struct dc_link *link,
        struct hdcp_protection_message *message_info)
 {
+       if (message_info->msg_id == HDCP_MESSAGE_ID_INVALID) {
+               DC_LOG_ERROR("%s: Invalid message_info msg_id - %d\n", 
__func__, message_info->msg_id);
+               return false;
+       }
+
        return dpcd_access_helper(
                link,
                message_info->length,
-- 
2.34.1