[PATCH v2] media: i2c: thp7312: bound the focus lookup against the table size

[Guo Zihao <guozh23@xiaopeng.com>]

thp7312_set_focus() indexes thp7312_focus_values[] with the value of the
V4L2_CID_FOCUS_ABSOLUTE control:

        if (thp7312->focus_absolute->is_new) {
                unsigned int value;

                value = thp7312_focus_values[thp7312->focus_absolute->val];

The control is registered with the table size as its maximum:

        v4l2_ctrl_new_std(hdl, &thp7312_ctrl_ops,
                          V4L2_CID_FOCUS_ABSOLUTE,
                          0, ARRAY_SIZE(thp7312_focus_values),
                          1, 0);

The table has 19 entries, so the valid indices are 0 to 18, but the
maximum passed to the control is 19. The control framework does not
reject the bound itself for an integer control: std_validate_elem() only
rounds the value into [minimum, maximum] through ROUND_TO_RANGE() and
returns 0, whereas a menu control returns -ERANGE for a value outside the
range. So a value of 19 is accepted and the lookup reads one entry past
the end of the array. That value is then written to the sensor through
cci_write(THP7312_REG_MANUAL_FOCUS_POSITION).

Reject a value that is not a valid index before the lookup. The control
range is the safer place for the bound, but leaving the lookup guarded
keeps the table and its only user consistent with each other; narrowing
the control is a follow-up that does not affect this fix.

No Fixes tag. The table, its registration and the lookup all come from
the initial driver import, 7a52ab415b43 ("media: i2c: Add driver for
THine THP7312"), and have not been touched since.

Reviewed-by: Liu Weibin <liuwb@xiaopeng.com>
Assisted-by: LLM
Signed-off-by: Guo Zihao <guozh23@xiaopeng.com>
---
v2: add the THP7312 maintainers to the recipients, and say that the value
    read out of range is written to the sensor.

    The previous version said the read was of a value next to the table
    and left it at that. The read result goes into cci_write() for
    THP7312_REG_MANUAL_FOCUS_POSITION, so the description now follows the
    value to where it is used.

    Add the Assisted-by tag.
---
 drivers/media/i2c/thp7312.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/i2c/thp7312.c b/drivers/media/i2c/thp7312.c
index 775cfba18..20698b7a1 100644
--- a/drivers/media/i2c/thp7312.c
+++ b/drivers/media/i2c/thp7312.c
@@ -931,6 +931,11 @@ static int thp7312_set_focus(struct thp7312_device *thp7312)
 	if (thp7312->focus_absolute->is_new) {
 		unsigned int value;
 
+		if (thp7312->focus_absolute->val < 0 ||
+		    thp7312->focus_absolute->val >=
+		    ARRAY_SIZE(thp7312_focus_values))
+			return -EINVAL;
+
 		value = thp7312_focus_values[thp7312->focus_absolute->val];
 
 		ret = cci_write(thp7312->regmap,
-- 
2.50.1