[PATCH] media: dvb-frontends: cx24116: validate firmware size

[Pengpeng Hou]

The firmware diagnostic reads the first two and final two bytes without
proving that the firmware object contains at least two bytes.

Reject undersized firmware before the diagnostic and upload path consume
it.

Fixes: 0d46748c3f87 ("V4L/DVB (8986): cx24116: Adding DVB-S2 demodulator support")
Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
 drivers/media/dvb-frontends/cx24116.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c
index c10053a7cb829..e9f8ff5231287 100644
--- a/drivers/media/dvb-frontends/cx24116.c
+++ b/drivers/media/dvb-frontends/cx24116.c
@@ -556,6 +556,8 @@ static int cx24116_load_firmware(struct dvb_frontend *fe,
 	unsigned char vers[4];
 
 	dprintk("%s\n", __func__);
+	if (fw->size < 2)
+		return -EINVAL;
 	dprintk("Firmware is %zu bytes (%02x %02x .. %02x %02x)\n",
 			fw->size,
 			fw->data[0],
@@ -1494,4 +1496,3 @@ static const struct dvb_frontend_ops cx24116_ops = {
 MODULE_DESCRIPTION("DVB Frontend module for Conexant cx24116/cx24118 hardware");
 MODULE_AUTHOR("Steven Toth");
 MODULE_LICENSE("GPL");
-

base-commit: 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72
-- 
2.50.1