DF-4827 / fix.diff
--- a/dce_i2c_sw.c +++ b/dce_i2c_sw.c @@ -532,7 +532,14 @@ enum gpio_ddc_line line; struct dce_i2c_sw *engine = NULL; - if (get_hw_supported_ddc_line(ddc, &line)) + /* + * sw_i2cs[] is sized MAX_PIPES, NOT GPIO_DDC_LINE_COUNT - the + * VGA (6) and I2C-pad (7) DDC lines pass get_hw_supported_ddc_line's + * GPIO_DDC_LINE_COUNT bound but would index past the array into the + * scalar members of resource_pool. Bound by the array domain, as + * acquire_i2c_hw_engine() already does for hw_i2cs[] (dce_i2c_hw.c). + */ + if (get_hw_supported_ddc_line(ddc, &line) && line < pool->pipe_count) engine = pool->sw_i2cs[line]; if (!engine) |