mirrors/libfprint
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/libfprint/libfprint.git synced 2026-09-09 04:40:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fpi-usb-transfer: Avoid hex dump on cancelled transfers

Browse Source 
When a USB transfer is cancelled, actual_length is set to -1. This
gets implicitly cast to gsize (unsigned) in log_transfer(), resulting
in a huge length passed to fp_dbg_hex_dump_data() and causing a
segfault.

Only dump data when the length is within valid bounds.
This commit is contained in:
Jason Huang
2026-07-25 21:21:50 +00:00
committed by Marco Trevisan
parent de5d539b50
commit 84a33b7d59
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libfprint/fpi-usb-transfer.c
+8 -4
View File
@@ -44,6 +44,8 @@ log_transfer (FpiUsbTransfer *transfer, gboolean submit, GError *error)
{
if (fpi_log_is_debug_transfer_enabled ())
{
gboolean is_incoming = !!(transfer->endpoint & FPI_USB_ENDPOINT_IN);
if (!submit)
{
g_autofree gchar *error_str = NULL;
@@ -67,11 +69,13 @@ log_transfer (FpiUsbTransfer *transfer, gboolean submit, GError *error)
transfer->endpoint);
}
if (!submit == !!(transfer->endpoint & FPI_USB_ENDPOINT_IN))
if (submit != is_incoming)
{
fp_dbg_hex_dump_data (transfer->buffer,
(transfer->endpoint & FPI_USB_ENDPOINT_IN) ?
transfer->actual_length : transfer->length);
gsize dump_length = is_incoming ? transfer->actual_length : transfer->length;
/* Skip hex dump if actual_length is invalid (e.g., -1 on cancelled IN transfers) */
if (dump_length <= transfer->length)
fp_dbg_hex_dump_data (transfer->buffer, dump_length);
}
}
}