depau/libfprint
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

upekts: fix memory corruption

Browse source 
Found by valgrind
This commit is contained in:
Daniel Drake 2007-10-16 14:34:47 +01:00
parent 680142f268
commit 801fcfc07c
1 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
libfprint/drivers/upekts.c
View file

@ -177,6 +177,7 @@ static int send_cmd(struct fp_dev *dev, unsigned char seq_a,
static int send_cmd28(struct fp_dev *dev, unsigned char subcmd, static int send_cmd28(struct fp_dev *dev, unsigned char subcmd,
unsigned char *data, uint16_t innerlen) unsigned char *data, uint16_t innerlen)
{ {
uint16_t _innerlen = innerlen;
size_t len = innerlen + 6; size_t len = innerlen + 6;
unsigned char *buf = g_malloc0(len); unsigned char *buf = g_malloc0(len);
struct upekts_dev *upekdev = dev->priv; struct upekts_dev *upekdev = dev->priv;
@ -185,10 +186,10 @@ static int send_cmd28(struct fp_dev *dev, unsigned char subcmd,
fp_dbg("seq=%02x subcmd=%02x with %d bytes of data", seq, subcmd, innerlen); fp_dbg("seq=%02x subcmd=%02x with %d bytes of data", seq, subcmd, innerlen);
innerlen = cpu_to_le16(innerlen + 3); _innerlen = cpu_to_le16(innerlen + 3);
buf[0] = 0x28; buf[0] = 0x28;
buf[1] = innerlen & 0x00ff; buf[1] = _innerlen & 0x00ff;
buf[2] = (innerlen & 0xff00) >> 8; buf[2] = (_innerlen & 0xff00) >> 8;
buf[5] = subcmd; buf[5] = subcmd;
memcpy(buf + 6, data, innerlen); memcpy(buf + 6, data, innerlen);