[bug report] media: coda: jpeg: add CODA960 JPEG encoder support

[Dan Carpenter <dan.carpenter@oracle.com>]

Hello Philipp Zabel,

The patch 96f6f62c4656: "media: coda: jpeg: add CODA960 JPEG encoder
support" from Dec 12, 2019, leads to the following Smatch static
checker warning:

	drivers/media/platform/chips-media/coda-jpeg.c:622 coda9_jpeg_gen_enc_huff_tab()
	warn: check that incremented offset 'k' is capped

drivers/media/platform/chips-media/coda-jpeg.c
    583 static int coda9_jpeg_gen_enc_huff_tab(struct coda_ctx *ctx, int tab_num,
    584                                        int *ehufsi, int *ehufco)
    585 {
    586         int i, j, k, lastk, si, code, maxsymbol;
    587         const u8 *bits, *huffval;
    588         struct {
    589                 int size[256];
    590                 int code[256];
    591         } *huff;
    592         static const unsigned char *huff_tabs[4] = {
    593                 luma_dc, luma_ac, chroma_dc, chroma_ac,
    594         };
    595         int ret = -EINVAL;
    596 
    597         huff = kzalloc(sizeof(*huff), GFP_KERNEL);
    598         if (!huff)
    599                 return -ENOMEM;
    600 
    601         bits = huff_tabs[tab_num];
    602         huffval = huff_tabs[tab_num] + 16;
    603 
    604         maxsymbol = tab_num & 1 ? 256 : 16;
    605 
    606         /* Figure C.1 - Generation of table of Huffman code sizes */
    607         k = 0;
    608         for (i = 1; i <= 16; i++) {
    609                 j = bits[i - 1];
    610                 if (k + j > maxsymbol)
    611                         goto out;
    612                 while (j--)
    613                         huff->size[k++] = i;
    614         }
    615         lastk = k;
    616 
    617         /* Figure C.2 - Generation of table of Huffman codes */
    618         k = 0;
    619         code = 0;
    620         si = huff->size[0];
    621         while (k < lastk) {
                       ^^^^^^^^^
Here we know that k is valid.

--> 622                 while (huff->size[k] == si) {
    623                         huff->code[k++] = code;

But this loop iterates through k without checking if k is still valid.
How do we know that the huff->size[k] check won't read beyond the end
of the loop?  Presumably it won't go far beyond the end before it hits
something which is != si.

    624                         code++;
    625                 }
    626                 if (code >= (1 << si))
    627                         goto out;
    628                 code <<= 1;
    629                 si++;
    630         }
    631 
    632         /* Figure C.3 - Ordering procedure for encoding procedure code tables */
    633         for (k = 0; k < lastk; k++) {
    634                 i = huffval[k];
    635                 if (i >= maxsymbol || ehufsi[i])
    636                         goto out;
    637                 ehufco[i] = huff->code[k];
    638                 ehufsi[i] = huff->size[k];
    639         }
    640 
    641         ret = 0;
    642 out:
    643         kfree(huff);
    644         return ret;
    645 }

regards,
dan carpenter