From 39e006e5630d8caa6dc4005f3e2fab2aa18b907b Mon Sep 17 00:00:00 2001 From: Richard Hughes Date: Wed, 27 Oct 2021 14:12:21 +0100 Subject: [PATCH] wacom-usb: Fix a potentially unsafe memcpy() Spotted by Coverity. --- plugins/wacom-usb/fu-wac-module-touch.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/plugins/wacom-usb/fu-wac-module-touch.c b/plugins/wacom-usb/fu-wac-module-touch.c index 959bbf1bb..c39a7f9cc 100644 --- a/plugins/wacom-usb/fu-wac-module-touch.c +++ b/plugins/wacom-usb/fu-wac-module-touch.c @@ -82,7 +82,15 @@ fu_wac_module_touch_write_firmware(FuDevice *device, buf[1] = fu_chunk_get_idx(chk) + 1; fu_common_write_uint32(&buf[2], fu_chunk_get_address(chk), G_LITTLE_ENDIAN); buf[6] = 0x10; /* no idea! */ - memcpy(&buf[7], fu_chunk_get_data(chk), fu_chunk_get_data_sz(chk)); + if (!fu_memcpy_safe(buf, + sizeof(buf), + 0x07, /* dst */ + fu_chunk_get_data(chk), + fu_chunk_get_data_sz(chk), + 0x0, /* src */ + fu_chunk_get_data_sz(chk), + error)) + return FALSE; blob_chunk = g_bytes_new(buf, sizeof(buf)); if (!fu_wac_module_set_feature(self, FU_WAC_MODULE_COMMAND_DATA,