[PATCH] media: atomisp: reject short _DSM packages

[Kang Chen]

gmin_get_config_dsm_var() walks the package returned by the atomisp
_DSM function, but it does not reject packages with fewer than two
elements.  count is unsigned, so an empty package makes count - 1
evaluate to UINT_MAX and the loop walks far past the end of the
elements array, reading unrelated memory.

Require at least two elements before scanning the key/value pairs.

Fixes: 387041cda44e ("media: atomisp: improve sensor detection code to use _DSM table")
Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>
---
 drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
index d628fe4dca6d..159b72c1eb40 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c
@@ -1167,6 +1167,13 @@ static int gmin_get_config_dsm_var(struct device *dev,
 		return -EINVAL;
 	}
 
+	if (obj->package.count < 2) {
+		dev_info(dev, "Invalid _DSM package count %u\n",
+			 obj->package.count);
+		ACPI_FREE(obj);
+		return -EINVAL;
+	}
+
 #if 0 /* Just for debugging purposes */
 	for (i = 0; i < obj->package.count; i++) {
 		union acpi_object *cur = &obj->package.elements[i];
-- 
2.34.1