From 07152e43efe63a8afe792dd8e08431f8f7961c8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= <mail@3v1n0.net>
Date: Tue, 30 Jun 2026 13:50:48 +0200
Subject: [PATCH] realtek: Fail on shorter data read that may lead to an
 underflow

Reported by: Keith Linneman (LinnemanLabs)
---
 libfprint/drivers/realtek/realtek.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libfprint/drivers/realtek/realtek.c b/libfprint/drivers/realtek/realtek.c
index 7bfb1a57..edf549b5 100644
--- a/libfprint/drivers/realtek/realtek.c
+++ b/libfprint/drivers/realtek/realtek.c
@@ -638,6 +638,14 @@ fp_cmd_receive_cb (FpiUsbTransfer *transfer,
     {
       g_autofree guchar *read_buf = NULL;
 
+      if ((gsize) transfer->actual_length < self->trans_data_len)
+        {
+          fpi_ssm_mark_failed (transfer->ssm,
+                               fpi_device_error_new_msg (FP_DEVICE_ERROR_PROTO,
+                                                         "Truncated data received"));
+          return;
+        }
+
       read_buf = g_malloc0 (sizeof (guchar) * (self->trans_data_len));
       memcpy (read_buf, transfer->buffer, self->trans_data_len);
       self->read_data = g_steal_pointer (&read_buf);