Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Huang Guobin <huangguobin4@huawei.com>
To:     <haren@us.ibm.com>, <ddstreet@ieee.org>,
        <herbert@gondor.apana.org.au>
CC:     <linux-kernel@vger.kernel.org>
Subject: [PATCH] lib: Verify array index is correct before using it
Date:   Thu, 23 Jul 2020 09:48:07 -0400
Message-ID: <20200723134807.35027-1-huangguobin4@huawei.com>
MIME-Version: 1.0
Content-Type: text/plain
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

This code reads from the array before verifying that "c" is a valid
index. Move test array offset code before use to fix it.

Fixes: 2da572c959dd ("lib: add software 842 compression/decompression")
Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
---
 lib/842/842_compress.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/lib/842/842_compress.c b/lib/842/842_compress.c
index c02baa4168e1..10f9f8a0d05b 100644
--- a/lib/842/842_compress.c
+++ b/lib/842/842_compress.c
@@ -222,12 +222,13 @@ static int add_bits(struct sw842_param *p, u64 d, u8 n)
 static int add_template(struct sw842_param *p, u8 c)
 {
 	int ret, i, b = 0;
-	u8 *t = comp_ops[c];
+	u8 *t = NULL;
 	bool inv = false;
 
 	if (c >= OPS_MAX)
 		return -EINVAL;
 
+	t = comp_ops[c];
 	pr_debug("template %x\n", t[4]);
 
 	ret = add_bits(p, t[4], OP_BITS);
@@ -379,12 +380,14 @@ static int add_end_template(struct sw842_param *p)
 
 static bool check_template(struct sw842_param *p, u8 c)
 {
-	u8 *t = comp_ops[c];
+	u8 *t = NULL;
 	int i, match, b = 0;
 
 	if (c >= OPS_MAX)
 		return false;
 
+	t = comp_ops[c];
+
 	for (i = 0; i < 4; i++) {
 		if (t[i] & OP_ACTION_INDEX) {
 			if (t[i] & OP_AMOUNT_2)
-- 
2.17.1