From 657c764b7330a27c955511f71c8643ed187de568 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= Date: Tue, 30 Jun 2026 13:48:00 +0200 Subject: [PATCH] uru4000: Ensure we do not overflow image buffer on reading Reported by: Keith Linneman (LinnemanLabs) --- libfprint/drivers/uru4000.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/libfprint/drivers/uru4000.c b/libfprint/drivers/uru4000.c index f2e6b09c..c3cf2a54 100644 --- a/libfprint/drivers/uru4000.c +++ b/libfprint/drivers/uru4000.c @@ -755,6 +755,17 @@ imaging_run_state (FpiSsm *ssm, FpDevice *_dev) if (num_lines == 0) break; + /* num_lines is device-supplied; make sure decoding this block stays + * within the captured image buffer (IMAGE_HEIGHT rows). */ + if ((size_t) self->img_lines_done + num_lines > IMAGE_HEIGHT) + { + fp_err ("bad captured image: block %d (%d lines) overflows buffer", + self->img_block, num_lines); + fpi_ssm_mark_failed (ssm, + fpi_device_error_new (FP_DEVICE_ERROR_PROTO)); + return; + } + fp_dbg ("%d %02x %d", self->img_block, flags, num_lines); if (flags & BLOCKF_CHANGE_KEY)