[PATCH] media: si2168: validate new-format firmware record length

[Pengpeng Hou]

The new-format si2168 firmware loop processes fixed 17-byte records: one
length byte followed by 16 command bytes. The existing check ensures
that len fits in the destination command array, but SI2168_ARGLEN is 30,
so that check does not prove that len fits inside the current 16-byte
record.

Reject records whose length byte is greater than the current record
payload size before passing the record payload to cmd_init().

Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c
--- a/drivers/media/dvb-frontends/si2168.c
+++ b/drivers/media/dvb-frontends/si2168.c
@@ -463,7 +463,7 @@
 		/* firmware is in the new format */
 		for (remaining = fw->size; remaining > 0; remaining -= 17) {
 			len = fw->data[fw->size - remaining];
-			if (len > SI2168_ARGLEN) {
+			if (len > SI2168_ARGLEN || len > 16) {
 				ret = -EINVAL;
 				break;
 			}