proxmox-mirrors/fwupd
1
0
Fork 0
mirror of https://git.proxmox.com/git/fwupd synced 2025-08-14 02:40:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

logitech-hidpp: Fix possible unsafe memcpy()

Browse Source 
PVS: A call of the 'memcpy' function will lead to underflow of the buffer.
This commit is contained in:
Richard Hughes 2022-09-09 11:57:44 +01:00
parent c19d7d8b9f
commit d8c464889a
2 changed files with 18 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
plugins/logitech-hidpp/fu-logitech-hidpp-bootloader-texas.c
View File

@ -6,8 +6,6 @@
#include "config.h"
#include <string.h>
#include "fu-logitech-hidpp-bootloader-texas.h"
#include "fu-logitech-hidpp-common.h"
@ -185,7 +183,15 @@ fu_logitech_hidpp_bootloader_texas_write_firmware(FuDevice *device,
req->addr = payload->addr % 0x80;
req->len = payload->len;
memcpy(req->data, payload->data, payload->len);
if (!fu_memcpy_safe(req->data,
req->len,
0x0, /* dst */
payload->data,
payload->len,
0x0, /* src */
payload->len,
error))
return FALSE;
if (!fu_logitech_hidpp_bootloader_request(self, req, error)) {
g_prefix_error(error, "failed to write ram buffer @0x%02x: ", req->addr);
return FALSE;

12
plugins/logitech-hidpp/fu-logitech-hidpp-device.c
View File

@ -6,8 +6,6 @@
#include "config.h"
#include <string.h>
#include "fu-logitech-hidpp-common.h"
#include "fu-logitech-hidpp-device.h"
#include "fu-logitech-hidpp-hidpp.h"
@ -1102,7 +1100,15 @@ fu_logitech_hidpp_device_write_firmware_pkt(FuLogitechHidPpDevice *self,
/* enable transfer workaround for devices paired to Bolt receiver */
if (priv->device_idx != HIDPP_DEVICE_IDX_UNSET && priv->device_idx != HIDPP_DEVICE_IDX_BLE)
msg->flags = FU_UNIFYING_HIDPP_MSG_FLAG_RETRY_STUCK;
memcpy(msg->data, data, 16);
if (!fu_memcpy_safe(msg->data,
sizeof(msg->data),
0x0, /* dst */
data,
16,
0x0, /* src */
16,
error))
return FALSE;
if (!fu_logitech_hidpp_transfer(priv->io_channel, msg, error)) {
g_prefix_error(error, "failed to supply program data: ");
return FALSE;