From 2aa415f23398c8a58c4f63f838dcba2a62ff6db5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= <mail@3v1n0.net>
Date: Tue, 30 Jun 2026 19:37:45 +0200
Subject: [PATCH] upekts: Validate inner length value before using it

---
 libfprint/drivers/upekts.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libfprint/drivers/upekts.c b/libfprint/drivers/upekts.c
index 828306bb..d1191275 100644
--- a/libfprint/drivers/upekts.c
+++ b/libfprint/drivers/upekts.c
@@ -308,6 +308,14 @@ __handle_incoming_msg (FpDevice             *device,
         fp_dbg ("non-zero bytes in cmd response");
 
       innerlen = innerbuf[1] | (innerbuf[2] << 8);
+      if (innerlen < 3 || innerlen > len - 3)
+        {
+          fp_warn ("cmd response has invalid inner length (%d)", innerlen);
+          error = fpi_device_error_new_msg (FP_DEVICE_ERROR_PROTO,
+                                            "CMD response has invalid inner length");
+          goto err;
+        }
+
       innerlen = innerlen - 3;
       _subcmd = innerbuf[5];
       fp_dbg ("device responds to subcmd %x with %d bytes", _subcmd, innerlen);