Re: [PATCH] media: dvb-frontends: ds3000: validate firmware size

[Jonathan Corbet]

Pengpeng Hou <pengpeng@xxxxxxxxxxx> writes:

> The firmware diagnostic reads the first two and final two bytes without
> proving that the firmware object contains at least two bytes.
>
> Reject undersized firmware before the diagnostic and upload path consume
> it.
>
> Fixes: 09ea33e5c696 ("V4L/DVB (13493): TeVii S470 and TBS 6920 fixes")
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> ---
>  drivers/media/dvb-frontends/ds3000.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c
> index ce7ae424b27cc..76d2eb98932ae 100644
> --- a/drivers/media/dvb-frontends/ds3000.c
> +++ b/drivers/media/dvb-frontends/ds3000.c
> @@ -374,6 +374,8 @@ static int ds3000_load_firmware(struct dvb_frontend *fe,
>  	int ret = 0;
>  
>  	dprintk("%s\n", __func__);
> +	if (fw->size < 2)
> +		return -EINVAL;

So, you have generated an awful lot of fixes all over the tree in the
last few months.  Can you tell us about what tool you are using to find
and fix these bugs, and how you are testing your fixes?

Thanks,

jon