From 84a33b7d59addbfa4ae4319f715d831ee2333714 Mon Sep 17 00:00:00 2001 From: Jason Huang Date: Wed, 1 Jul 2026 16:35:27 +0800 Subject: [PATCH] fpi-usb-transfer: Avoid hex dump on cancelled transfers When a USB transfer is cancelled, actual_length is set to -1. This gets implicitly cast to gsize (unsigned) in log_transfer(), resulting in a huge length passed to fp_dbg_hex_dump_data() and causing a segfault. Only dump data when the length is within valid bounds. --- libfprint/fpi-usb-transfer.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/libfprint/fpi-usb-transfer.c b/libfprint/fpi-usb-transfer.c index 9dba910e..65354cc9 100644 --- a/libfprint/fpi-usb-transfer.c +++ b/libfprint/fpi-usb-transfer.c @@ -44,6 +44,8 @@ log_transfer (FpiUsbTransfer *transfer, gboolean submit, GError *error) { if (fpi_log_is_debug_transfer_enabled ()) { + gboolean is_incoming = !!(transfer->endpoint & FPI_USB_ENDPOINT_IN); + if (!submit) { g_autofree gchar *error_str = NULL; @@ -67,11 +69,13 @@ log_transfer (FpiUsbTransfer *transfer, gboolean submit, GError *error) transfer->endpoint); } - if (!submit == !!(transfer->endpoint & FPI_USB_ENDPOINT_IN)) + if (submit != is_incoming) { - fp_dbg_hex_dump_data (transfer->buffer, - (transfer->endpoint & FPI_USB_ENDPOINT_IN) ? - transfer->actual_length : transfer->length); + gsize dump_length = is_incoming ? transfer->actual_length : transfer->length; + + /* Skip hex dump if actual_length is invalid (e.g., -1 on cancelled IN transfers) */ + if (dump_length <= transfer->length) + fp_dbg_hex_dump_data (transfer->buffer, dump_length); } } }