mirrors/libfprint
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/libfprint/libfprint.git synced 2026-09-10 13:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

synaptics: Do not trust device's enrolled fingers if it leads to an overflow

Browse Source 
The device may report a number of enrolled fingers but this value is not
checked against the data, so let's do it to prevent an overflow

Reported by: Keith Linneman (LinnemanLabs)
This commit is contained in:
Marco Trevisan (Treviño)
2026-07-13 08:13:46 +00:00
committed by Marco Trevisan
parent da497eed89
commit 791d17e4c3
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libfprint/drivers/synaptics/bmkt_message.c
+9 -1
View File
@@ -177,17 +177,25 @@ parse_get_enrolled_fingers_report (bmkt_msg_resp_t *msg_resp, bmkt_response_t *r
if (msg_resp->payload_len < 2) if (msg_resp->payload_len < 2)
return BMKT_UNRECOGNIZED_MESSAGE; return BMKT_UNRECOGNIZED_MESSAGE;
/* 2 bytes per finger so calculate the total number of fingers to process*/ /* 2 bytes per finger so calculate the total number of fingers to process*/
int num_fingers = (msg_resp->payload_len) / 2; int num_fingers = (msg_resp->payload_len) / 2;
bmkt_enrolled_fingers_resp_t *get_enrolled_fingers_resp = &resp->response.enrolled_fingers_resp; bmkt_enrolled_fingers_resp_t *get_enrolled_fingers_resp = &resp->response.enrolled_fingers_resp;
if (num_fingers > (int) G_N_ELEMENTS (get_enrolled_fingers_resp->fingers))
{
g_warning ("Device reported more enrolled fingers (%d) than supported",
num_fingers);
num_fingers = G_N_ELEMENTS (get_enrolled_fingers_resp->fingers);
}
for (i = 0; i < num_fingers; i++) for (i = 0; i < num_fingers; i++)
{ {
get_enrolled_fingers_resp->fingers[i].finger_id = extract8 (msg_resp->payload, &offset); get_enrolled_fingers_resp->fingers[i].finger_id = extract8 (msg_resp->payload, &offset);
get_enrolled_fingers_resp->fingers[i].template_status = extract8 (msg_resp->payload, &offset); get_enrolled_fingers_resp->fingers[i].template_status = extract8 (msg_resp->payload, &offset);
} }
return BMKT_SUCCESS; return BMKT_SUCCESS;
} }
static int static int