[PATCH v2] media: dvb-frontends: ds3000: validate firmware size

[PATCH v2] media: dvb-frontends: ds3000: validate firmware size

[Pengpeng Hou]

The firmware diagnostic accesses the first two and last two bytes
without proving that the image contains two bytes. An undersized image
can therefore be read outside its bounds when the diagnostic is enabled.

Reject images smaller than two bytes before the diagnostic or upload
path consumes them.

The issue was found by our static-analysis tool.

Fixes: 09ea33e5c696 ("V4L/DVB (13493): TeVii S470 and TBS 6920 fixes")
Assisted-by: gpt 5
Signed-off-by: Pengpeng Hou <hppiscas@163.com>
---
Changes since v1:
https://lore.kernel.org/all/20260830124034.95459-1-pengpeng@iscas.ac.cn/
Include the tool-discovery and coding-assistance provenance requested by
Jonathan Corbet; retain the two-byte minimum check.

 drivers/media/dvb-frontends/ds3000.c |    3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c
index ce7ae424b27c..9cc97ca7bbcc 100644
--- a/drivers/media/dvb-frontends/ds3000.c
+++ b/drivers/media/dvb-frontends/ds3000.c
@@ -373,6 +373,9 @@ static int ds3000_load_firmware(struct dvb_frontend *fe,
 	struct ds3000_state *state = fe->demodulator_priv;
 	int ret = 0;
 
+	if (fw->size < 2)
+		return -EINVAL;
+
 	dprintk("%s\n", __func__);
 	dprintk("Firmware is %zu bytes (%02x %02x .. %02x %02x)\n",
 			fw->size,

base-commit: 518e5b794c06c0f0eb40df3e202274a66202c137
-- 
2.50.1 (Apple Git-155)