[PATCH v2] media: si2157: validate firmware record bounds

Si2157 firmware is parsed as 17-byte records containing a one-byte
command length and 16 payload bytes. Checking the length only against
SI2157_ARGLEN protects the destination but not the source record.

Name the record sizes and require each command to fit both the current
record payload and the destination array. An empty image does not enter
the record loop, so leave that existing behavior unchanged.

Fixes: a828d72df216 ("[media] si2157: Bounds check firmware")
Cc: [email protected]

Assisted-by: Codex:gpt-5
Signed-off-by: Pengpeng Hou <[email protected]>
---
Changes since v1: https://lore.kernel.org/all/[email protected]/
- no source-code changes
- clarify that an empty image keeps its existing behavior
- rebase on current media sources and add the coding-assistant disclosure

The record layout and both bounds were reviewed statically; malformed
firmware was not exercised at runtime.

 drivers/media/tuners/si2157.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c
index d517a91e6fbc..340df0f99a11 100644
--- a/drivers/media/tuners/si2157.c
+++ b/drivers/media/tuners/si2157.c
@@ -13,6 +13,9 @@ static int tuner_lock_debug;
 module_param(tuner_lock_debug, int, 0644);
 MODULE_PARM_DESC(tuner_lock_debug, "if set, signal lock is briefly waited on after setting params");
 
+#define SI2157_FIRMWARE_RECORD_SIZE 17
+#define SI2157_FIRMWARE_RECORD_PAYLOAD_SIZE (SI2157_FIRMWARE_RECORD_SIZE - 1)
+
 /* execute firmware command */
 static int si2157_cmd_execute(struct i2c_client *client, struct si2157_cmd *cmd)
 {
@@ -103,7 +106,7 @@ static int si2157_load_firmware(struct dvb_frontend *fe,
 		return ret;
 
 	/* firmware should be n chunks of 17 bytes */
-	if (fw->size % 17 != 0) {
+	if (fw->size % SI2157_FIRMWARE_RECORD_SIZE != 0) {
 		dev_err(&client->dev, "firmware file '%s' is invalid\n",
 			fw_name);
 		ret = -EINVAL;
@@ -113,9 +116,11 @@ static int si2157_load_firmware(struct dvb_frontend *fe,
 	dev_info(&client->dev, "downloading firmware from file '%s'\n",
 		 fw_name);
 
-	for (remaining = fw->size; remaining > 0; remaining -= 17) {
+	for (remaining = fw->size; remaining > 0;
+	     remaining -= SI2157_FIRMWARE_RECORD_SIZE) {
 		len = fw->data[fw->size - remaining];
-		if (len > SI2157_ARGLEN) {
+		if (len > SI2157_FIRMWARE_RECORD_PAYLOAD_SIZE ||
+		    len > SI2157_ARGLEN) {
 			dev_err(&client->dev, "Bad firmware length\n");
 			ret = -EINVAL;
 			goto err_release_firmware;
-- 
2.50.1 (Apple Git-155)