Re: [PATCH v2] media: ttusb-dec: validate command request and response lengths

[George Emmanuel Thomas]

Hi Pengpeng,

I tested this patch with a malformed USB response that previously
triggered a KASAN slab-out-of-bounds in ttusb_dec_send_command() with
a reported read size of 75 bytes.

With this patch applied, the same reproducer reports:

  ttusb_dec_send_command: invalid result length 75
  ttusb-dec 1-1:1.0: probe with driver ttusb-dec failed with error -71

There is no KASAN report, and the reproducer exits normally.

Tested-by: George Emmanuel Thomas <georgeemmanuelthomas@xxxxxxxxx>

Thanks,
George