From nobody Sat Jul 25 17:34:01 2026 Received: from cstnet.cn (smtp25.cstnet.cn [159.226.251.25]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0DC2D3C345C; Wed, 15 Jul 2026 08:41:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.25 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784104894; cv=none; b=YV/+2ODG6fwHJENltggYrfO4pkqTYaPdcgSqbWotnRilWKdhwNGbYCQUrTl+9spUrKF+BthsZoNk/DUiUAurMm/JRju8O2pyoWZ+XxRozq36axERlhqewpWpSr8QjeQf/FLHQ2ObHheTDVZpRHtR1wlMuni4nW0LhWQ2A+g/My4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784104894; c=relaxed/simple; bh=jyRdSyg7s3aj3Fj9U7kGLdqDvXdEdiqQdZzBoKLR5ss=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=TgYZTQrbwLSbv/GBb3sk96XD/y/kCZanjFlsAsS6hr2GoqCoTwM6pH1g+ArUd+XdP+k6TXwJ7Wi5mq3j0tIutW0QfJPLdIdrYLhdgdwzBJDjcd6VciqHZ62oBU95YCuEQBlfiweVdB5+Kuj1ZrtnqOwXcV6b/ZZu0vBpfF5rP08= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.25 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from localhost.localdomain (unknown [111.196.245.140]) by APP-05 (Coremail) with SMTP id zQCowABnw9a5R1dqkGZHGA--.8411S2; Wed, 15 Jul 2026 16:41:29 +0800 (CST) From: Pengpeng Hou To: Mauro Carvalho Chehab Cc: Pengpeng Hou , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] media: validate type 04 Cypress firmware record length Date: Wed, 15 Jul 2026 16:41:29 +0800 Message-ID: <20260715084129.36795-1-pengpeng@iscas.ac.cn> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zQCowABnw9a5R1dqkGZHGA--.8411S2 X-Coremail-Antispam: 1UD129KBjvJXoW7ArWxXry8uFWxJF4UAF45Awb_yoW8Zry7pa yjqF4jyFWkKrs3Z34DJ3W3CFWrXwn3Xay5GrnxC3Za9F48Ca4DArWrKFWjgr15Jr1fA3sF qF4YqryfGFy5AF7anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUyC14x267AKxVWUJVW8JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26F1j6w1UM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVWxJr0_GcWl84ACjcxK6I8E87Iv6xkF7I0E14v26r xl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj 6xIIjxv20xvE14v26r1q6rW5McIj6I8E87Iv67AKxVW8JVWxJwAm72CE4IkC6x0Yz7v_Jr 0_Gr1lF7xvr2IYc2Ij64vIr41lF7I21c0EjII2zVCS5cI20VAGYxC7MxAIw28IcxkI7VAK I48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7 xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUAVWUtwCIc40Y0x0EwIxGrwCI42IY6xII jxv20xvE14v26r4j6ryUMIIF0xvE2Ix0cI8IcVCY1x0267AKxVWxJVW8Jr1lIxAIcVCF04 k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r4j6F4UMIIF0xvEx4A2jsIEc7Cj xVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x0JUsiSdUUUUU= X-CM-SenderInfo: pshqw1xhqjqxpvfd2hldfou0/ Content-Type: text/plain; charset="utf-8" Both Cypress firmware parsers treat an Intel HEX type 04 record as containing two address bytes, but only validate generic record framing. A zero-length type 04 record at the end of a firmware blob can make b[5] read past the blob; a one-byte record makes b[5] refer to the checksum rather than current record data. Reject type 04 records shorter than two bytes before reading the address payload. The two routines are independent implementations, but they parse the same Intel HEX type 04 record and fail under the same short-record condition. Keep the identical validation in one atomic media patch so their malformed-record behavior cannot diverge. Signed-off-by: Pengpeng Hou --- drivers/media/common/cypress_firmware.c | 2 ++ drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/drivers/media/common/cypress_firmware.c b/drivers/media/common= /cypress_firmware.c index 66274fdf5243..edbde98b64fe 100644 --- a/drivers/media/common/cypress_firmware.c +++ b/drivers/media/common/cypress_firmware.c @@ -59,6 +59,8 @@ static int cypress_get_hexline(const struct firmware *fw, if (hx->type =3D=3D 0x04) { /* b[4] and b[5] are the Extended linear address record data * field */ + if (hx->len < 2) + return -EINVAL; hx->addr |=3D (b[4] << 24) | (b[5] << 16); } =20 diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/u= sb/dvb-usb/dvb-usb-firmware.c index 0fb3fa6100e4..0da2e4604c3f 100644 --- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c +++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c @@ -141,6 +141,8 @@ int dvb_usb_get_hexline(const struct firmware *fw, stru= ct hexline *hx, =20 if (hx->type =3D=3D 0x04) { /* b[4] and b[5] are the Extended linear address record data field */ + if (hx->len < 2) + return -EINVAL; hx->addr |=3D (b[4] << 24) | (b[5] << 16); /* hx->len -=3D 2; data_offs +=3D 2; */ --=20 2.43.0