mirrors/libfprint
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/libfprint/libfprint.git synced 2026-09-10 13:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

etes603: Handle buffer over/under-flows

Browse Source 
Reported by: Keith Linneman (LinnemanLabs)
This commit is contained in:
Marco Trevisan (Treviño)
2026-07-13 08:13:46 +00:00
committed by Marco Trevisan
parent c025abcd15
commit 63be3884d6
1 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libfprint/drivers/etes603.c
+19
View File
@@ -338,7 +338,14 @@ msg_parse_regs (FpiDeviceEtes603 *dev)
struct egis_msg *msg_req = dev->req; struct egis_msg *msg_req = dev->req;
struct egis_msg *msg_ans = dev->ans; struct egis_msg *msg_ans = dev->ans;
g_return_val_if_fail (dev->ans_len >= MSG_HDR_SIZE, -1);
n_args = dev->ans_len - MSG_HDR_SIZE; n_args = dev->ans_len - MSG_HDR_SIZE;
if (n_args > REG_MAX)
{
g_warn_if_reached ();
n_args = REG_MAX;
}
if (msg_header_check (msg_ans)) if (msg_header_check (msg_ans))
return -1; return -1;
@@ -575,12 +582,24 @@ static void
process_removefpi_end (FpiDeviceEtes603 *dev) process_removefpi_end (FpiDeviceEtes603 *dev)
{ {
unsigned int i; unsigned int i;
/* Need at least the 2-line empty pattern to compare against. */
if (dev->fp_height < 2)
g_return_if_reached ();
/* 2 last lines with Fly-Estimation are the empty pattern. */ /* 2 last lines with Fly-Estimation are the empty pattern. */
guint8 *pattern = dev->fp + (dev->fp_height - 2) * FE_WIDTH / 2; guint8 *pattern = dev->fp + (dev->fp_height - 2) * FE_WIDTH / 2;
for (i = 2; i < dev->fp_height; i += 2) for (i = 2; i < dev->fp_height; i += 2)
if (memcmp (pattern, pattern - (i * FE_WIDTH / 2), FE_WIDTH)) if (memcmp (pattern, pattern - (i * FE_WIDTH / 2), FE_WIDTH))
break; break;
if (i > dev->fp_height)
{
g_warn_if_reached ();
i = dev->fp_height;
}
dev->fp_height -= i; dev->fp_height -= i;
fp_dbg ("Removing %d empty lines from image", i - 2); fp_dbg ("Removing %d empty lines from image", i - 2);
} }