drath/libratbag
1
0
Fork 1
mirror of https://github.com/libratbag/libratbag.git synced 2026-11-08 07:33:53 +01:00
Code Issues Projects Releases Wiki Activity

Avoid overflow when reading dpi list

Browse Source 
LONG_MESSAGE_LENGTH is the length of the full message so we should
take the first parts of the union into account.
This commit is contained in:
Thomas Hindoe Paaboel Andersen
2015-09-02 21:47:23 +02:00
parent f30ea0dc4d
commit 5f2d538e10
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/hidpp20.c
View File

@@ -779,7 +779,7 @@ hidpp20_adjustable_dpi_get_dpi_list(struct ratbag_device *device,
sensor->dpi_min = 0xffff;
sensor->index = msg.msg.parameters[0];
while (i < LONG_MESSAGE_LENGTH - 1 &&
while (i < LONG_MESSAGE_LENGTH - 4U &&
hidpp20_get_unaligned_u16(&msg.msg.parameters[i]) != 0) {
uint16_t value = hidpp20_get_unaligned_u16(&msg.msg.parameters[i]);