From f15a62b5aa7a171a265b3970607bc5dc9be07edb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= Date: Tue, 30 Jun 2026 12:16:59 +0200 Subject: [PATCH] goodixmoc: Handle invalid finger number A modified device may supply invalid data, leading to libfprint crashes Reported by: Keith Linneman (LinnemanLabs) --- libfprint/drivers/goodixmoc/goodix_proto.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/libfprint/drivers/goodixmoc/goodix_proto.c b/libfprint/drivers/goodixmoc/goodix_proto.c index 9bcb6fe4..acdacd69 100644 --- a/libfprint/drivers/goodixmoc/goodix_proto.c +++ b/libfprint/drivers/goodixmoc/goodix_proto.c @@ -416,6 +416,13 @@ gx_proto_parse_body (uint16_t cmd, FpiByteReader *byte_reader, pgxfp_cmd_respons &presp->finger_list_resp.finger_num)) g_return_val_if_reached (-1); + if (presp->finger_list_resp.finger_num > FP_MAX_FINGERNUM) + { + g_warning ("Device reported too many fingers (%d)", + presp->finger_list_resp.finger_num); + return -1; + } + for(uint8_t num = 0; num < presp->finger_list_resp.finger_num; num++) { uint16_t fingerid_length;