depau/libfprint
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

elan: Fix use-after-free if USB transfer is cancelled

Browse source
This commit is contained in:
Bastien Nocera 2018-09-27 15:19:00 +02:00
parent e532524c7e
commit 0ace5f64f8
1 changed files with 9 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
libfprint/drivers/elan.c
View file

@ -324,11 +324,18 @@ static void elan_cmd_cb(struct libusb_transfer *transfer,
fpi_ssm *ssm, fpi_ssm *ssm,
void *user_data) void *user_data)
{ {
struct fp_img_dev *dev = FP_IMG_DEV(_dev); struct fp_img_dev *dev;
struct elan_dev *elandev = FP_INSTANCE_DATA(_dev); struct elan_dev *elandev;
G_DEBUG_HERE(); G_DEBUG_HERE();
if (transfer->status == LIBUSB_TRANSFER_CANCELLED) {
fp_dbg("transfer cancelled");
return;
}
dev = FP_IMG_DEV(_dev);
elandev = FP_INSTANCE_DATA(_dev);
elandev->cur_transfer = NULL; elandev->cur_transfer = NULL;
switch (transfer->status) { switch (transfer->status) {
@ -349,11 +356,6 @@ static void elan_cmd_cb(struct libusb_transfer *transfer,
elan_cmd_read(ssm, dev); elan_cmd_read(ssm, dev);
} }
break; break;
case LIBUSB_TRANSFER_CANCELLED:
fp_dbg("transfer cancelled");
fpi_ssm_mark_failed(ssm, -ECANCELED);
elan_deactivate(dev);
break;
case LIBUSB_TRANSFER_TIMED_OUT: case LIBUSB_TRANSFER_TIMED_OUT:
fp_dbg("transfer timed out"); fp_dbg("transfer timed out");
fpi_ssm_mark_failed(ssm, -ETIMEDOUT); fpi_ssm_mark_failed(ssm, -ETIMEDOUT);