DrathOrg/libratbag-plus
1
0
Fork 0
forked from drath/libratbag
Code Pull Requests Activity

hidpp10/20: fix a buffer overflow

Browse Source 
We pass a negative length into log_buffer which expects a size_t.
This causes it to write past the allocated output_buf.
This commit is contained in:
Thomas Hindoe Paaboel Andersen
2015-09-15 20:13:54 +02:00
parent a85a40b713
commit ab7b620dd4
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/hidpp10.c
View File

@@ -151,7 +151,7 @@ hidpp10_request_command(struct hidpp10_device *dev, union hidpp10_message *msg)
*/
read_buffer.msg.device_idx = msg->msg.device_idx;
log_buf_raw(ratbag, " *** received: ", read_buffer.data, ret);
log_buf_raw(ratbag, " *** received: ", read_buffer.data, ret > 0 ? ret : 0);
/* actual answer */

2
src/hidpp20.c
View File

@@ -123,7 +123,7 @@ hidpp20_request_command_allow_error(struct ratbag_device *device, union hidpp20_
ret = ratbag_hidraw_read_input_report(device, read_buffer.data, LONG_MESSAGE_LENGTH);
}
log_buf_raw(ratbag, " *** received: ", read_buffer.data, ret);
log_buf_raw(ratbag, " *** received: ", read_buffer.data, ret > 0 ? ret : 0);
if (read_buffer.msg.report_id != REPORT_ID_SHORT &&
read_buffer.msg.report_id != REPORT_ID_LONG)