From c56f45e37b75cdfbaee88df40168cee1834db191 Mon Sep 17 00:00:00 2001 From: Luca Weiss Date: Thu, 10 Apr 2025 20:58:30 +0200 Subject: driver: Stop copying any custom frame data when parameters are invalid While the initial idea of this check was to sanitize any a row_length value which is too high. But in reality we should just essentially error out (which due to the function signature we can't do properly), and stop trying to memcpy any data. Issue: https://github.com/openrazer/openrazer/issues/2433 --- driver/razerchromacommon.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/driver/razerchromacommon.c b/driver/razerchromacommon.c index ef9891f9..1e7cdc11 100644 --- a/driver/razerchromacommon.c +++ b/driver/razerchromacommon.c @@ -480,7 +480,7 @@ struct razer_report razer_chroma_standard_matrix_set_custom_frame(unsigned char if (row_length > sizeof(report.arguments) - start_arg_offset) { printk(KERN_ALERT "razerchroma: RGB data too long\n"); - row_length = sizeof(report.arguments) - start_arg_offset; + row_length = 0; } report = get_razer_report(0x03, 0x0B, 0x46); // In theory should be able to leave data size at max as we have start/stop @@ -766,7 +766,7 @@ struct razer_report razer_chroma_extended_matrix_set_custom_frame2(unsigned char if (row_length > sizeof(report.arguments) - start_arg_offset) { printk(KERN_ALERT "razerchroma: RGB data too long\n"); - row_length = sizeof(report.arguments) - start_arg_offset; + row_length = 0; } // Some devices need a specific packet length, most devices are happy with 0x47 @@ -1039,7 +1039,7 @@ struct razer_report razer_chroma_misc_one_row_set_custom_frame(unsigned char sta if (row_length > sizeof(report.arguments) - start_arg_offset) { printk(KERN_ALERT "razerchroma: RGB data too long\n"); - row_length = sizeof(report.arguments) - start_arg_offset; + row_length = 0; } report.arguments[0] = start_col; -- 2.30.2