diff options
Diffstat (limited to 'backend/magicolor.c')
| -rw-r--r-- | backend/magicolor.c | 44 |
1 files changed, 37 insertions, 7 deletions
diff --git a/backend/magicolor.c b/backend/magicolor.c index af9fb1a..0b079fa 100644 --- a/backend/magicolor.c +++ b/backend/magicolor.c @@ -114,7 +114,7 @@ static struct MagicolorCap magicolor_cap[] = { /* KONICA MINOLTA magicolor 1690MF, USB ID 0x123b:2089 */ { - 0x2089, "mc1690mf", "KONICA MINOLTA magicolor 1690MF", "1.3.6.1.4.1.183341.1.1.2.1.32.3.2", + 0x2089, "mc1690mf", "KONICA MINOLTA magicolor 1690MF", ".1.3.6.1.4.1.18334.1.1.1.1.1.23.1.1", -1, 0x85, 600, {150, 600, 0}, magicolor_default_resolutions, 3, /* 600 dpi max, 3 resolutions */ 8, magicolor_default_depths, /* color depth 8 default, 1 and 8 possible */ @@ -836,6 +836,26 @@ cmd_get_scanning_parameters(SANE_Handle handle, *data_pixels, *data_pixels, *lines, *lines, *pixels_per_line, *pixels_per_line); + + /* + * SECURITY REMEDIATION + * See gitlab issue #279 - Issue10 SIGFPE in mc_setup_block_mode + * + * pixels_per_line cannot be zero, otherwise a division by zero error can occur later. + * Added checking the parameters to ensure that this issue cannot occur. + * + * Additionally to the reported issue, it makes no sense for any of the values of + * data_pixels, lines or pixels_per_line to be zero. I do not have any knowledge + * of valid maximums for these parameters. + * + */ + if ((*data_pixels == 0) || (*lines == 0) || (*pixels_per_line == 0)) { + DBG (1, "%s: ERROR: Returned image parameters contain invalid " + "bytes. Zero values for these parameters are not rational.\n", + __func__); + dump_hex_buffer_dense (1, rxbuf, 8); + return SANE_STATUS_INVAL; + } } return status; @@ -1525,8 +1545,10 @@ mc_get_device_from_identification (const char*ident) { int n; for (n = 0; n < NELEMS (magicolor_cap); n++) { - if (strcmp (magicolor_cap[n].model, ident) || strcmp (magicolor_cap[n].OID, ident)) + if ((strcmp (magicolor_cap[n].model, ident) == 0) || (strcmp (magicolor_cap[n].OID, ident) == 0)) + { return &magicolor_cap[n]; + } } return NULL; } @@ -1833,9 +1855,9 @@ mc_network_discovery_handle (struct snmp_pdu *pdu, snmp_discovery_data *magic) oid anOID[MAX_OID_LEN]; size_t anOID_len = MAX_OID_LEN; /* Device information variables */ - char ip_addr[1024]; - char model[1024]; - char device[1024]; + char ip_addr[1024] = ""; + char model[1024] = ""; + char device[1024] = ""; /* remote IP detection variables */ netsnmp_indexed_addr_pair *responder = (netsnmp_indexed_addr_pair *) pdu->transport_data; struct sockaddr_in *remote = NULL; @@ -1884,6 +1906,13 @@ mc_network_discovery_handle (struct snmp_pdu *pdu, snmp_discovery_data *magic) DBG (3, "%s: SystemObjectID does not return an OID, device is not a magicolor device\n", __func__); return 0; } + + // Make sure that snprint_objid gives us just numbers, instead of a + // SNMPv2-SMI::enterprises prefix. + netsnmp_ds_set_int(NETSNMP_DS_LIBRARY_ID, + NETSNMP_DS_LIB_OID_OUTPUT_FORMAT, + NETSNMP_OID_OUTPUT_NUMERIC); + snprint_objid (device, sizeof(device), vp->val.objid, value_len); DBG (5, "%s: Device object ID is '%s'\n", __func__, device); @@ -1903,8 +1932,9 @@ mc_network_discovery_handle (struct snmp_pdu *pdu, snmp_discovery_data *magic) read_objid(MAGICOLOR_SNMP_SYSDESCR_OID, anOID, &anOID_len); vp = find_varbind_in_list (varlist, anOID, anOID_len); if (vp) { - memcpy(model,vp->val.string,vp->val_len); - model[vp->val_len] = '\0'; + size_t model_len = min(vp->val_len, sizeof(model) - 1); + memcpy(model, vp->val.string, model_len); + model[model_len] = '\0'; DBG (5, "%s: Found model: %s\n", __func__, model); } |