From 3cc0ae79e75c7b0b9b3b9702feabb3c7ef86706f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= <mail@3v1n0.net>
Date: Tue, 30 Jun 2026 13:17:45 +0200
Subject: [PATCH] fpc: Prevent a buffer-overflow on data reading

Reported by: Keith Linneman (LinnemanLabs)
---
 libfprint/drivers/fpcmoc/fpc.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/libfprint/drivers/fpcmoc/fpc.c b/libfprint/drivers/fpcmoc/fpc.c
index 6f976952..d0fae35e 100644
--- a/libfprint/drivers/fpcmoc/fpc.c
+++ b/libfprint/drivers/fpcmoc/fpc.c
@@ -173,6 +173,15 @@ fpc_cmd_receive_cb (FpiUsbTransfer *transfer,
               return;
             }
 
+          if (transfer->actual_length > sizeof (fpc_cmd_response_t))
+            {
+              fp_err ("%s recv evt data length (%ld) exceeds buffer size (%ld)",
+                      G_STRFUNC, transfer->actual_length, sizeof (fpc_cmd_response_t));
+              fpi_ssm_mark_failed (transfer->ssm,
+                                   fpi_device_error_new (FP_DEVICE_ERROR_DATA_INVALID));
+              return;
+            }
+
           data->resp_len = transfer->actual_length;
 
           if (data->callback)