From 973aa65d4c83959a25b0bbcb5e093e1043046afc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= Date: Tue, 30 Jun 2026 19:54:31 +0200 Subject: [PATCH] vfs301: Handle unexpected data length gracefully --- libfprint/drivers/vfs301_proto.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/libfprint/drivers/vfs301_proto.c b/libfprint/drivers/vfs301_proto.c index 6c25098c..5d014437 100644 --- a/libfprint/drivers/vfs301_proto.c +++ b/libfprint/drivers/vfs301_proto.c @@ -348,7 +348,11 @@ vfs301_extract_image (FpDeviceVfs301 *vfs, guint8 *output, int *output_height int last_line; int i; - g_assert (vfs->scanline_count >= 1); + if (vfs->scanline_count < 1 || scanlines == NULL) + { + *output_height = 0; + g_return_if_reached (); + } *output_height = 1; memcpy (output, scanlines, VFS301_FP_OUTPUT_WIDTH); @@ -447,7 +451,8 @@ vfs301_proto_process_data (FpDeviceVfs301 *dev, int first_block, const guint8 *b if (first_block) { - g_assert (len >= VFS301_FP_FRAME_SIZE); + if (len < VFS301_FP_FRAME_SIZE) + g_return_val_if_reached (img_process_data (first_block, dev, buf, 0)); /* Skip bytes until start_sequence is found */ for (i = 0; i < VFS301_FP_FRAME_SIZE; i++, buf++, len--)