github/esphome
2
0
Fork 0
mirror of https://github.com/esphome/esphome.git synced 2026-09-15 00:58:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

[fingerprint_grow] Fix OOB write and uint16 overflow (#14462)

Browse Source 
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jonathan Swoboda
2026-03-04 12:58:52 -05:00
committed by GitHub
co-authored by Claude Opus 4.6
parent 246a8bff0c
commit c37ab1de84
2 changed files with 14 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
esphome/components/fingerprint_grow/fingerprint_grow.cpp
+12 -11
View File
@@ -361,7 +361,7 @@ void FingerprintGrowComponent::aura_led_control(uint8_t state, uint8_t speed, ui
}
}
uint8_t FingerprintGrowComponent::transfer_(std::vector<uint8_t> *p_data_buffer) {
uint8_t FingerprintGrowComponent::transfer_(std::vector<uint8_t> &data_buffer) {
while (this->available())
this->read();
this->write((uint8_t) (START_CODE >> 8));
@@ -372,12 +372,12 @@ uint8_t FingerprintGrowComponent::transfer_(std::vector<uint8_t> *p_data_buffer)
this->write(this->address_[3]);
this->write(COMMAND);
uint16_t wire_length = p_data_buffer->size() + 2;
uint16_t wire_length = data_buffer.size() + 2;
this->write((uint8_t) (wire_length >> 8));
this->write((uint8_t) (wire_length & 0xFF));
uint16_t sum = (wire_length >> 8) + (wire_length & 0xFF) + COMMAND;
for (auto data : *p_data_buffer) {
for (auto data : data_buffer) {
this->write(data);
sum += data;
}
@@ -385,7 +385,7 @@ uint8_t FingerprintGrowComponent::transfer_(std::vector<uint8_t> *p_data_buffer)
this->write((uint8_t) (sum >> 8));
this->write((uint8_t) (sum & 0xFF));
p_data_buffer->clear();
data_buffer.clear();
uint8_t byte;
uint16_t idx = 0, length = 0;
@@ -431,9 +431,9 @@ uint8_t FingerprintGrowComponent::transfer_(std::vector<uint8_t> *p_data_buffer)
length |= byte;
break;
default:
p_data_buffer->push_back(byte);
data_buffer.push_back(byte);
if ((idx - 8) == length) {
switch ((*p_data_buffer)[0]) {
switch (data_buffer[0]) {
case OK:
case NO_FINGER:
case IMAGE_FAIL:
@@ -453,25 +453,26 @@ uint8_t FingerprintGrowComponent::transfer_(std::vector<uint8_t> *p_data_buffer)
ESP_LOGE(TAG, "Reader failed to process request");
break;
default:
ESP_LOGE(TAG, "Unknown response received from reader: 0x%.2X", (*p_data_buffer)[0]);
ESP_LOGE(TAG, "Unknown response received from reader: 0x%.2X", data_buffer[0]);
break;
}
this->last_transfer_ms_ = millis();
return (*p_data_buffer)[0];
return data_buffer[0];
}
break;
}
idx++;
}
ESP_LOGE(TAG, "No response received from reader");
(*p_data_buffer)[0] = TIMEOUT;
data_buffer.clear();
data_buffer.push_back(TIMEOUT);
this->last_transfer_ms_ = millis();
return TIMEOUT;
}
uint8_t FingerprintGrowComponent::send_command_() {
this->sensor_wakeup_();
return this->transfer_(&this->data_);
return this->transfer_(this->data_);
}
void FingerprintGrowComponent::sensor_wakeup_() {
@@ -517,7 +518,7 @@ void FingerprintGrowComponent::sensor_wakeup_() {
std::vector<uint8_t> buffer = {VERIFY_PASSWORD, (uint8_t) (this->password_ >> 24), (uint8_t) (this->password_ >> 16),
(uint8_t) (this->password_ >> 8), (uint8_t) (this->password_ & 0xFF)};
if (this->transfer_(&buffer) != OK) {
if (this->transfer_(buffer) != OK) {
ESP_LOGE(TAG, "Wrong password");
}
}
esphome/components/fingerprint_grow/fingerprint_grow.h
+2 -2
View File
@@ -169,7 +169,7 @@ class FingerprintGrowComponent : public PollingComponent, public uart::UARTDevic
bool set_password_();
bool get_parameters_();
void get_fingerprint_count_();
uint8_t transfer_(std::vector<uint8_t> *p_data_buffer);
uint8_t transfer_(std::vector<uint8_t> &data_buffer);
uint8_t send_command_();
void sensor_wakeup_();
void sensor_sleep_();
@@ -190,7 +190,7 @@ class FingerprintGrowComponent : public PollingComponent, public uart::UARTDevic
bool is_sensor_awake_ = false;
uint32_t last_transfer_ms_ = 0;
uint32_t last_aura_led_control_ = 0;
uint16_t last_aura_led_duration_ = 0;
uint32_t last_aura_led_duration_ = 0;
uint16_t system_identifier_code_ = 0;
uint32_t idle_period_to_sleep_ms_ = UINT32_MAX;
sensor::Sensor *fingerprint_count_sensor_{nullptr};