proxmox-mirrors/fwupd
1
0
Fork 0
mirror of https://git.proxmox.com/git/fwupd synced 2025-08-14 15:50:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

wacom-raw: Fix an impossible to hit overflow (#3082)

Browse Source 
Spotted by Coverity.
This commit is contained in:
Richard Hughes 2021-03-31 16:30:59 +01:00 committed by GitHub
parent 541a71b140
commit 18dcb6f511
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
plugins/wacom-raw/fu-wacom-aes-device.c
View File

@ -175,10 +175,10 @@ fu_wacom_aes_device_write_block (FuWacomAesDevice *self,
guint32 idx, guint32 idx,
guint32 address, guint32 address,
const guint8 *data, const guint8 *data,
guint16 datasz, gsize datasz,
GError **error) GError **error)
{ {
guint blocksz = fu_wacom_device_get_block_sz (FU_WACOM_DEVICE (self)); gsize blocksz = fu_wacom_device_get_block_sz (FU_WACOM_DEVICE (self));
FuWacomRawRequest req = { FuWacomRawRequest req = {
.cmd = FU_WACOM_RAW_BL_CMD_WRITE_FLASH, .cmd = FU_WACOM_RAW_BL_CMD_WRITE_FLASH,
.echo = (guint8) idx + 1, .echo = (guint8) idx + 1,
@ -194,7 +194,7 @@ fu_wacom_aes_device_write_block (FuWacomAesDevice *self,
G_IO_ERROR, G_IO_ERROR,
G_IO_ERROR_FAILED, G_IO_ERROR_FAILED,
"block size 0x%x != 0x%x untested", "block size 0x%x != 0x%x untested",
datasz, (guint) blocksz); (guint) datasz, (guint) blocksz);
return FALSE; return FALSE;
} }
memcpy (&req.data, data, datasz); memcpy (&req.data, data, datasz);

2
plugins/wacom-raw/fu-wacom-device.c
View File

@ -39,7 +39,7 @@ fu_wacom_device_to_string (FuDevice *device, guint idt, GString *str)
fu_common_string_append_kx (str, idt, "FlashSize", priv->flash_size); fu_common_string_append_kx (str, idt, "FlashSize", priv->flash_size);
} }
guint gsize
fu_wacom_device_get_block_sz (FuWacomDevice *self) fu_wacom_device_get_block_sz (FuWacomDevice *self)
{ {
FuWacomDevicePrivate *priv = GET_PRIVATE (self); FuWacomDevicePrivate *priv = GET_PRIVATE (self);

2
plugins/wacom-raw/fu-wacom-device.h
View File

@ -44,5 +44,5 @@ gboolean fu_wacom_device_erase_all (FuWacomDevice *self,
GError **error); GError **error);
gboolean fu_wacom_device_check_mpu (FuWacomDevice *self, gboolean fu_wacom_device_check_mpu (FuWacomDevice *self,
GError **error); GError **error);
guint fu_wacom_device_get_block_sz (FuWacomDevice *self); gsize fu_wacom_device_get_block_sz (FuWacomDevice *self);
guint fu_wacom_device_get_base_addr (FuWacomDevice *self); guint fu_wacom_device_get_base_addr (FuWacomDevice *self);

8
plugins/wacom-raw/fu-wacom-emr-device.c
View File

@ -136,10 +136,10 @@ fu_wacom_emr_device_write_block (FuWacomEmrDevice *self,
guint32 idx, guint32 idx,
guint32 address, guint32 address,
const guint8 *data, const guint8 *data,
guint16 datasz, gsize datasz,
GError **error) GError **error)
{ {
guint blocksz = fu_wacom_device_get_block_sz (FU_WACOM_DEVICE (self)); gsize blocksz = fu_wacom_device_get_block_sz (FU_WACOM_DEVICE (self));
FuWacomRawRequest req = { FuWacomRawRequest req = {
.cmd = FU_WACOM_RAW_BL_CMD_WRITE_FLASH, .cmd = FU_WACOM_RAW_BL_CMD_WRITE_FLASH,
.echo = (guint8) idx + 1, .echo = (guint8) idx + 1,
@ -155,7 +155,7 @@ fu_wacom_emr_device_write_block (FuWacomEmrDevice *self,
G_IO_ERROR, G_IO_ERROR,
G_IO_ERROR_FAILED, G_IO_ERROR_FAILED,
"data size 0x%x too large for packet", "data size 0x%x too large for packet",
datasz); (guint) datasz);
return FALSE; return FALSE;
} }
if (datasz != blocksz) { if (datasz != blocksz) {
@ -163,7 +163,7 @@ fu_wacom_emr_device_write_block (FuWacomEmrDevice *self,
G_IO_ERROR, G_IO_ERROR,
G_IO_ERROR_FAILED, G_IO_ERROR_FAILED,
"block size 0x%x != 0x%x untested", "block size 0x%x != 0x%x untested",
datasz, (guint) blocksz); (guint) datasz, (guint) blocksz);
return FALSE; return FALSE;
} }