Skip to content

Commit 782cf0f

Browse files
committed
Fix Nspire device information response length
nsp_cmd_r_dev_infos validates the size output pointer but never assigns to it. get_version then uses an uninitialized length when copying the product name, which can truncate "TI-Nspire CX CAS" to "TI". Return the received payload size alongside the command and data, consistent with nsp_cmd_r_screen_rle.
1 parent 6b05504 commit 782cf0f

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

libticalcs/trunk/src/nsp_cmd.cc

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,7 @@ int TICALL nsp_cmd_r_dev_infos(CalcHandle *handle, uint8_t *cmd, uint32_t *size,
205205
if (!retval)
206206
{
207207
*cmd = pkt->cmd;
208+
*size = pkt->size;
208209
*data = (uint8_t *)g_malloc0(pkt->size);
209210
if (NULL != *data)
210211
{

0 commit comments

Comments
 (0)