proxmox-mirrors/fwupd
1
0
Fork 0
mirror of https://git.proxmox.com/git/fwupd synced 2025-08-15 13:59:15 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

wacom-usb: Fix a timeout when parsing very corrupt firmware

Browse Source 
Fixes https://oss-fuzz.com/testcase-detail/5797345020739584
This commit is contained in:
Richard Hughes 2022-04-27 19:30:00 +01:00
parent 89cfe97625
commit f5bbd744f5
1 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
plugins/wacom-usb/fu-wac-firmware.c
View File

@ -19,6 +19,7 @@ struct _FuWacFirmware {
G_DEFINE_TYPE(FuWacFirmware, fu_wac_firmware, FU_TYPE_FIRMWARE) G_DEFINE_TYPE(FuWacFirmware, fu_wac_firmware, FU_TYPE_FIRMWARE)
#define FU_WAC_FIRMWARE_TOKENS_MAX 100000 /* lines */ #define FU_WAC_FIRMWARE_TOKENS_MAX 100000 /* lines */
#define FU_WAC_FIRMWARE_SECTIONS_MAX 10
typedef struct { typedef struct {
guint32 addr; guint32 addr;
@ -71,6 +72,16 @@ fu_wac_firmware_tokenize_cb(GString *token, guint token_idx, gpointer user_data,
token->len); token->len);
return FALSE; return FALSE;
} }
/* sanity check */
if (helper->header_infos->len > FU_WAC_FIRMWARE_SECTIONS_MAX) {
g_set_error(error,
FWUPD_ERROR,
FWUPD_ERROR_INTERNAL,
"too many metadata sections: %u",
helper->header_infos->len);
return FALSE;
}
if (!fu_firmware_strparse_uint4_safe(token->str, if (!fu_firmware_strparse_uint4_safe(token->str,
token->len, token->len,
5, 5,