[PATCH] media: i2c: vd55g1: Bound the number of st,leds entries

[PATCH] media: i2c: vd55g1: Bound the number of st,leds entries

[Sergey Lebedev]

vd55g1_parse_dt_gpios() reads st,leds into a stack array of
VD55G1_NB_GPIOS entries, and vd55g1_parse_dt_gpios_array() reads as
many entries as the property has. The binding allows four, but nothing
checks that at run time, and on ACPI the property can come from a
software node or _DSD that no schema validates. A fifth entry is
written past the array.

Refuse more entries than the sensor has GPIOs.

Fixes: e56616d7b23c ("media: i2c: Add driver for ST VD55G1 camera sensor")
Signed-off-by: Sergey Lebedev <lsa.uz@pm.me>
---
Found while reviewing the vd55g0 driver, which has the same check.
There is no VD55G1 here, so this was tested with a module that runs
vd55g1_parse_dt_gpios_array(), copied unchanged, on a software node,
with a guard word after the four-entry array. Five st,leds entries
overwrite the guard and the call succeeds; with this patch it fails
with -EINVAL. Four entries parse as before.

Tool use, per Documentation/process/generated-content.rst (Assisted-by
tags in commits were dropped in 7.4-rc1):

* My contributions to this series were prepared with Claude Code
  (claude-opus-5-5); work by others in it is their own.
* This replaces any Assisted-by tags in earlier versions.

 drivers/media/i2c/vd55g1.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/media/i2c/vd55g1.c b/drivers/media/i2c/vd55g1.c
index e3939bb9bd4..2e847af3f1e 100644
--- a/drivers/media/i2c/vd55g1.c
+++ b/drivers/media/i2c/vd55g1.c
@@ -1854,6 +1854,11 @@ static int vd55g1_parse_dt_gpios_array(struct vd55g1 *sensor,
 		*nb = 0;
 		return 0;
 	}
+	if (*nb > VD55G1_NB_GPIOS) {
+		dev_err(sensor->dev, "%s lists %d GPIOs, the sensor has %d\n",
+			prop_name, *nb, VD55G1_NB_GPIOS);
+		return -EINVAL;
+	}
 
 	ret = device_property_read_u32_array(sensor->dev,
 					     prop_name, array, *nb);
-- 
2.54.0