Skip to content

Commit 55aab02

Browse files
authored
Fix Coverity CID 1530056: sanitize tainted allocation size in hid_report_reconstructor_test.c (#776)
Fixes: #563
1 parent dbb0e26 commit 55aab02

1 file changed

Lines changed: 5 additions & 0 deletions

File tree

windows/test/hid_report_reconstructor_test.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,11 @@ static hidp_preparsed_data * alloc_preparsed_data_from_file(char* filename)
123123

124124
if (FirstByteOfLinkCollectionArray != 0 && NumberLinkCollectionNodes != 0) {
125125
size_t size_of_preparsed_data = offsetof(hidp_preparsed_data, caps) + FirstByteOfLinkCollectionArray + (NumberLinkCollectionNodes * sizeof(hid_pp_link_collection_node));
126+
if (size_of_preparsed_data > 1024 * 1024) {
127+
fprintf(stderr, "Error: preparsed data size too large: %zu\n", size_of_preparsed_data);
128+
fclose(file);
129+
return NULL;
130+
}
126131
pp_data->FirstByteOfLinkCollectionArray = FirstByteOfLinkCollectionArray;
127132
pp_data->NumberLinkCollectionNodes = NumberLinkCollectionNodes;
128133
FirstByteOfLinkCollectionArray = 0;

0 commit comments

Comments
 (0)