[PATCH v2] media: or51211: validate firmware size before fixed-offset copies

[Pengpeng Hou]

or51211_load_firmware() copies bytes 0 through 392 into its staging
buffer, then uploads 8125 bytes starting at offset 393. The second copy
therefore reaches byte 8517, but the firmware size is not checked before
either fixed-offset access.

Define the minimum layout size and reject shorter firmware before the
first access.

Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
Changes since v1: https://lore.kernel.org/all/2026063009052493.5-ccfa108-0048-media-or51211-validate-firm-pengpeng@xxxxxxxxxxx/
- name the minimum fixed firmware layout size
- explain the first and last bytes consumed by the loader
- rebase on current media sources
- disclose the use of Codex

The fixed extents were reviewed statically. The short-firmware path was
not exercised on OR51211 hardware.

 drivers/media/dvb-frontends/or51211.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/dvb-frontends/or51211.c b/drivers/media/dvb-frontends/or51211.c
index 8c4aabef2d99..22f802c4e9fb 100644
--- a/drivers/media/dvb-frontends/or51211.c
+++ b/drivers/media/dvb-frontends/or51211.c
@@ -17,6 +17,7 @@
  * or /lib/firmware (depending on configuration of firmware hotplug).
  */
 #define OR51211_DEFAULT_FIRMWARE "dvb-fe-or51211.fw"
+#define OR51211_FIRMWARE_MIN_SIZE (393 + 8125)
 
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -99,6 +100,9 @@ static int or51211_load_firmware (struct dvb_frontend* fe,
 
 	dprintk("Firmware is %zu bytes\n", fw->size);
 
+	if (fw->size < OR51211_FIRMWARE_MIN_SIZE)
+		return -EINVAL;
+
 	/* Get eprom data */
 	tudata[0] = 17;
 	if (i2c_writebytes(state,0x50,tudata,1)) {
-- 
2.50.1 (Apple Git-155)