From ab7b620dd4966119b269064e0d421bb07135ffee Mon Sep 17 00:00:00 2001 From: Thomas Hindoe Paaboel Andersen Date: Tue, 15 Sep 2015 20:13:54 +0200 Subject: [PATCH] hidpp10/20: fix a buffer overflow We pass a negative length into log_buffer which expects a size_t. This causes it to write past the allocated output_buf. --- src/hidpp10.c | 2 +- src/hidpp20.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/hidpp10.c b/src/hidpp10.c index 55b4679c..29af0ee1 100644 --- a/src/hidpp10.c +++ b/src/hidpp10.c @@ -151,7 +151,7 @@ hidpp10_request_command(struct hidpp10_device *dev, union hidpp10_message *msg) */ read_buffer.msg.device_idx = msg->msg.device_idx; - log_buf_raw(ratbag, " *** received: ", read_buffer.data, ret); + log_buf_raw(ratbag, " *** received: ", read_buffer.data, ret > 0 ? ret : 0); /* actual answer */ diff --git a/src/hidpp20.c b/src/hidpp20.c index 466c0af5..54fff8b0 100644 --- a/src/hidpp20.c +++ b/src/hidpp20.c @@ -123,7 +123,7 @@ hidpp20_request_command_allow_error(struct ratbag_device *device, union hidpp20_ ret = ratbag_hidraw_read_input_report(device, read_buffer.data, LONG_MESSAGE_LENGTH); } - log_buf_raw(ratbag, " *** received: ", read_buffer.data, ret); + log_buf_raw(ratbag, " *** received: ", read_buffer.data, ret > 0 ? ret : 0); if (read_buffer.msg.report_id != REPORT_ID_SHORT && read_buffer.msg.report_id != REPORT_ID_LONG)