From 0c0baf639ef4352248a4ed8a6f0bf3924bbb65f5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= <mail@3v1n0.net>
Date: Tue, 30 Jun 2026 13:05:50 +0200
Subject: [PATCH] goodixmoc: Ensure we do not overflow when reading the payload

Reported by: Keith Linneman (LinnemanLabs)
---
 libfprint/drivers/goodixmoc/goodix_proto.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libfprint/drivers/goodixmoc/goodix_proto.c b/libfprint/drivers/goodixmoc/goodix_proto.c
index acdacd69..f191ec1b 100644
--- a/libfprint/drivers/goodixmoc/goodix_proto.c
+++ b/libfprint/drivers/goodixmoc/goodix_proto.c
@@ -296,6 +296,12 @@ gx_proto_parse_fingerid (FpiByteReader     *reader,
   if (!fpi_byte_reader_get_uint8 (reader, &template->payload.size))
     g_return_val_if_reached (-1);
 
+  if (template->payload.size > sizeof (template->payload.data))
+    {
+      g_warning ("Device reported oversized payload (%d)", template->payload.size);
+      return -1;
+    }
+
   if (!fpi_byte_reader_get_data (reader, template->payload.size, &buffer))
     g_return_val_if_reached (-1);