[PATCH] media: dvb-frontends: ds3000: validate firmware size

[Pengpeng Hou]

The firmware diagnostic reads the first two and final two bytes without
proving that the firmware object contains at least two bytes.

Reject undersized firmware before the diagnostic and upload path consume
it.

Fixes: 09ea33e5c696 ("V4L/DVB (13493): TeVii S470 and TBS 6920 fixes")
Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 drivers/media/dvb-frontends/ds3000.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c
index ce7ae424b27cc..76d2eb98932ae 100644
--- a/drivers/media/dvb-frontends/ds3000.c
+++ b/drivers/media/dvb-frontends/ds3000.c
@@ -374,6 +374,8 @@ static int ds3000_load_firmware(struct dvb_frontend *fe,
 	int ret = 0;
 
 	dprintk("%s\n", __func__);
+	if (fw->size < 2)
+		return -EINVAL;
 	dprintk("Firmware is %zu bytes (%02x %02x .. %02x %02x)\n",
 			fw->size,
 			fw->data[0],

base-commit: 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72
-- 
2.50.1