lib: make sure that we don't copy in a to large initresp from device

reported by Christian Reitter
Yubico · Jan 8, 2019 · e77a109 · e77a109
1 parent 375cfc4
commit e77a109
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/u2f-host/devs.c b/u2f-host/devs.c
@@ -247,6 +247,10 @@ init_device (u2fh_devs * devs, struct u2fdevice *dev)
        &resplen) == U2FH_OK)
     {
       U2FHID_INIT_RESP initresp;
+      if (resplen > sizeof (initresp))
+	{
+	  return U2FH_MEMORY_ERROR;
+	}
       memcpy (&initresp, resp, resplen);
       dev->cid = initresp.cid;
       dev->versionInterface = initresp.versionInterface;