mirrors/libfprint
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/libfprint/libfprint.git synced 2026-09-10 13:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

upekts: Validate inner length value before using it

Browse Source
This commit is contained in:
Marco Trevisan (Treviño)
2026-07-13 08:13:46 +00:00
committed by Marco Trevisan
parent 5ccf66dd2c
commit 2aa415f233
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libfprint/drivers/upekts.c
+8
View File
@@ -308,6 +308,14 @@ __handle_incoming_msg (FpDevice *device,
fp_dbg ("non-zero bytes in cmd response"); fp_dbg ("non-zero bytes in cmd response");
innerlen = innerbuf[1] | (innerbuf[2] << 8); innerlen = innerbuf[1] | (innerbuf[2] << 8);
if (innerlen < 3 || innerlen > len - 3)
{
fp_warn ("cmd response has invalid inner length (%d)", innerlen);
error = fpi_device_error_new_msg (FP_DEVICE_ERROR_PROTO,
"CMD response has invalid inner length");
goto err;
}
innerlen = innerlen - 3; innerlen = innerlen - 3;
_subcmd = innerbuf[5]; _subcmd = innerbuf[5];
fp_dbg ("device responds to subcmd %x with %d bytes", _subcmd, innerlen); fp_dbg ("device responds to subcmd %x with %d bytes", _subcmd, innerlen);