mirrors/libfprint
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/libfprint/libfprint.git synced 2026-09-10 13:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

fpi-usb-transfer: Avoid hex dump on cancelled transfers

Browse Source 
When a USB transfer is cancelled, actual_length is set to -1. This
gets implicitly cast to gsize (unsigned) in log_transfer(), resulting
in a huge length passed to fp_dbg_hex_dump_data() and causing a
segfault.

Only dump data when the length is within valid bounds.
This commit is contained in:
Jason Huang
2026-07-25 21:21:50 +00:00
committed by Marco Trevisan
parent de5d539b50
commit 84a33b7d59
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libfprint/fpi-usb-transfer.c
+8 -4
View File
@@ -44,6 +44,8 @@ log_transfer (FpiUsbTransfer *transfer, gboolean submit, GError *error)
{ {
if (fpi_log_is_debug_transfer_enabled ()) if (fpi_log_is_debug_transfer_enabled ())
{ {
gboolean is_incoming = !!(transfer->endpoint & FPI_USB_ENDPOINT_IN);
if (!submit) if (!submit)
{ {
g_autofree gchar *error_str = NULL; g_autofree gchar *error_str = NULL;
@@ -67,11 +69,13 @@ log_transfer (FpiUsbTransfer *transfer, gboolean submit, GError *error)
transfer->endpoint); transfer->endpoint);
} }
if (!submit == !!(transfer->endpoint & FPI_USB_ENDPOINT_IN)) if (submit != is_incoming)
{ {
fp_dbg_hex_dump_data (transfer->buffer, gsize dump_length = is_incoming ? transfer->actual_length : transfer->length;
(transfer->endpoint & FPI_USB_ENDPOINT_IN) ?
transfer->actual_length : transfer->length); /* Skip hex dump if actual_length is invalid (e.g., -1 on cancelled IN transfers) */
if (dump_length <= transfer->length)
fp_dbg_hex_dump_data (transfer->buffer, dump_length);
} }
} }
} }