From c30f7678872cc4101d0e3f639da7dd2c6554f56b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= <mail@3v1n0.net>
Date: Tue, 30 Jun 2026 19:16:27 +0200
Subject: [PATCH] aesx660: Ignore oversized payloads

---
 libfprint/drivers/aesx660.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/libfprint/drivers/aesx660.c b/libfprint/drivers/aesx660.c
index 846df638..8941c28c 100644
--- a/libfprint/drivers/aesx660.c
+++ b/libfprint/drivers/aesx660.c
@@ -384,6 +384,15 @@ capture_read_stripe_data_cb (FpiUsbTransfer *transfer,
 
       payload_length = priv->stripe_packet->data[AESX660_RESPONSE_SIZE_LSB_OFFSET] +
                        (priv->stripe_packet->data[AESX660_RESPONSE_SIZE_MSB_OFFSET] << 8);
+
+      if (payload_length > AESX660_BULK_TRANSFER_SIZE)
+        {
+          fp_dbg ("Oversized payload length %" G_GSSIZE_FORMAT ", discarding",
+                  payload_length);
+          g_byte_array_set_size (priv->stripe_packet, 0);
+          break;
+        }
+
       fp_dbg ("Got frame, type %.2x payload of size %.4lx",
               priv->stripe_packet->data[AESX660_RESPONSE_TYPE_OFFSET],
               (long) payload_length);