From dcf794eb9f0e7e599bf18627b87b654c57a10ab2 Mon Sep 17 00:00:00 2001 From: Ilya Zhuravlev Date: Fri, 25 Dec 2020 14:29:04 -0500 Subject: [PATCH] via: ensure correct buffer size is passed in --- quantum/via.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/quantum/via.c b/quantum/via.c index 253cecae67..ee102d180c 100644 --- a/quantum/via.c +++ b/quantum/via.c @@ -357,13 +357,15 @@ void raw_hid_receive(uint8_t *data, uint8_t length) { case id_dynamic_keymap_macro_get_buffer: { uint16_t offset = (command_data[0] << 8) | command_data[1]; uint16_t size = command_data[2]; // size <= 28 - dynamic_keymap_macro_get_buffer(offset, size, &command_data[3]); + if (size <= 28) + dynamic_keymap_macro_get_buffer(offset, size, &command_data[3]); break; } case id_dynamic_keymap_macro_set_buffer: { uint16_t offset = (command_data[0] << 8) | command_data[1]; uint16_t size = command_data[2]; // size <= 28 - dynamic_keymap_macro_set_buffer(offset, size, &command_data[3]); + if (size <= 28) + dynamic_keymap_macro_set_buffer(offset, size, &command_data[3]); break; } case id_dynamic_keymap_macro_reset: { @@ -377,13 +379,15 @@ void raw_hid_receive(uint8_t *data, uint8_t length) { case id_dynamic_keymap_get_buffer: { uint16_t offset = (command_data[0] << 8) | command_data[1]; uint16_t size = command_data[2]; // size <= 28 - dynamic_keymap_get_buffer(offset, size, &command_data[3]); + if (size <= 28) + dynamic_keymap_get_buffer(offset, size, &command_data[3]); break; } case id_dynamic_keymap_set_buffer: { uint16_t offset = (command_data[0] << 8) | command_data[1]; uint16_t size = command_data[2]; // size <= 28 - dynamic_keymap_set_buffer(offset, size, &command_data[3]); + if (size <= 28) + dynamic_keymap_set_buffer(offset, size, &command_data[3]); break; } case id_eeprom_reset: {