[PATCH] media: or51211: validate firmware size before fixed-offset copies

[Pengpeng Hou]

or51211_load_firmware() copies and uploads fixed firmware ranges,
including data at offset 393 with length 8125.

Reject firmware images smaller than the required fixed layout before
accessing those offsets.

Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 drivers/media/dvb-frontends/or51211.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/dvb-frontends/or51211.c b/drivers/media/dvb-frontends/or51211.c
index 8c4aabe..08a1768 100644
--- a/drivers/media/dvb-frontends/or51211.c
+++ b/drivers/media/dvb-frontends/or51211.c
@@ -99,6 +99,9 @@ static int or51211_load_firmware (struct dvb_frontend* fe,
 
 	dprintk("Firmware is %zu bytes\n", fw->size);
 
+	if (fw->size < 393 + 8125)
+		return -EINVAL;
+
 	/* Get eprom data */
 	tudata[0] = 17;
 	if (i2c_writebytes(state,0x50,tudata,1)) {