touch/usi: check color index validity

8-bit color is used as the index of the color8-to-color24 conversion
table(from USI spcification). The table has 141 entries so need to make
sure the index is between 0 and 140.

Bug: 364736113
Test: no crash with "adb$ usi_test -p /dev/g_usi_hidraw set --color 150"

Change-Id: I67ee0f292e938a0e7a3406235fb087ab3bf9af95
Signed-off-by: Hyungwoo Yang <hyungwooyang@google.com>

usi/goog_usi_stylus.c

diff --git a/usi/goog_usi_stylus.c b/usi/goog_usi_stylus.c
index 52cadc9..e51db85 100644
--- a/usi/goog_usi_stylus.c
+++ b/usi/goog_usi_stylus.c
@@ -1935,6 +1935,18 @@
 	return color8_idx;
 }
 
+static bool g_usi_color8_to_color24(int color8_idx, u8 *r, u8 *g, u8 *b)
+{
+	if (color8_idx < 0 || color8_idx >= ARRAY_SIZE(true_colors))
+		return false;
+
+	*r = true_colors[color8_idx].r;
+	*g = true_colors[color8_idx].g;
+	*b = true_colors[color8_idx].b;
+
+	return true;
+}
+
 /*
  * convert button info: USI button value to HID button value
  *
@@ -2155,10 +2167,9 @@
 		} else {
 			color8 = usi_ctx->stylus_capability[4];
 
-			/* color8 to color24 */
-			buf[2] = true_colors[color8].b; /* Blue Value */
-			buf[3] = true_colors[color8].g; /* Green Value */
-			buf[4] = true_colors[color8].r; /* Red Value */
+			/* convert color8 to color24 - buf[2]:blue, buf[3]:green, buf[4]:red */
+			if (g_usi_color8_to_color24(color8, buf + 4, buf + 3, buf + 2) == false)
+				return -ENODATA;
 		}
 
 		break;
@@ -2212,7 +2223,7 @@
 	int i;
 	u16 cmd_data = 0;
 	u8 stylus_has_button = 0x20;		/* refer to C.GetCapability() in USI 2.0 spec */
-	u8 color8 = 0;
+	u8 color8 = 0, r, g, b;
 
 	if (!usi_ctx->cbs->g_usi_send_uplink) {
 		G_USI_ERR("Set Feature Request is not supported");
@@ -2228,14 +2239,15 @@
 			return -EINVAL;
 
 		color8 = buf[2];
-		if (is_true_color_supported(usi_ctx)) {
-			cmd_data = 0x0100 | true_colors[color8].b;
+		if (is_true_color_supported(usi_ctx) &&
+		    g_usi_color8_to_color24(color8, &r, &g, &b)) {
+			cmd_data = 0x0100 | b;
 			g_usi_send_write_cmd(usi_ctx, 1, G_USI_SET_COLOR, cmd_data);
 
-			cmd_data = 0x0200 | true_colors[color8].g;
+			cmd_data = 0x0200 | g;
 			g_usi_send_write_cmd(usi_ctx, 1, G_USI_SET_COLOR, cmd_data);
 
-			cmd_data = 0x0400 | true_colors[color8].r;
+			cmd_data = 0x0400 | r;
 			g_usi_send_write_cmd(usi_ctx, 1, G_USI_SET_COLOR, cmd_data);
 		}