From: Pengpeng Hou <pengpeng@iscas.ac.cn>
To: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Pengpeng Hou <pengpeng@iscas.ac.cn>,
linux-media@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] media: dvb-frontends: ds3000: validate firmware size
Date: Sun, 30 Aug 2026 20:39:50 +0800 [thread overview]
Message-ID: <20260830124034.95459-1-pengpeng@iscas.ac.cn> (raw)
The firmware diagnostic reads the first two and final two bytes without
proving that the firmware object contains at least two bytes.
Reject undersized firmware before the diagnostic and upload path consume
it.
Fixes: 09ea33e5c696 ("V4L/DVB (13493): TeVii S470 and TBS 6920 fixes")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
drivers/media/dvb-frontends/ds3000.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c
index ce7ae424b27cc..76d2eb98932ae 100644
--- a/drivers/media/dvb-frontends/ds3000.c
+++ b/drivers/media/dvb-frontends/ds3000.c
@@ -374,6 +374,8 @@ static int ds3000_load_firmware(struct dvb_frontend *fe,
int ret = 0;
dprintk("%s\n", __func__);
+ if (fw->size < 2)
+ return -EINVAL;
dprintk("Firmware is %zu bytes (%02x %02x .. %02x %02x)\n",
fw->size,
fw->data[0],
base-commit: 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72
--
2.50.1
next reply other threads:[~2026-08-30 12:40 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-30 12:39 Pengpeng Hou [this message]
2026-08-30 14:45 ` Jonathan Corbet
2026-08-30 22:45 ` 侯朋朋
2026-08-30 23:06 ` Jonathan Corbet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260830124034.95459-1-pengpeng@iscas.ac.cn \
--to=pengpeng@iscas.ac.cn \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®