diff options
| author |   Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-08-30 21:29:58 +0800 |
|---|---|---|
| committer |   David Heidelberg <david@ixit.cz> | 2026-09-23 22:13:17 +0200 |
| commit | 7f2ea5ed588c03d481f0301e6c3d4240132383fb (patch) | |
| tree | d5acf3e617d3d993d4b2ca963367703decb0001e | |
| parent | nfc: fix use-after-free in nfc_get_local_general_bytes (diff) | |
nfc: st21nfca: validate ISO15693 inventory length
The ISO15693 inventory helper removes a two-byte prefix without checking
that it exists, then accepts a one-byte remainder before reading data[1] as
the DSFID.
Require the prefix and at least two remaining bytes before copying the UID
data and reading the DSFID.
Fixes: 7974728094d3 ("NFC: st21nfca: Add ISO15693 Reader/Writer support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260830132958.6397-1-pengpeng@iscas.ac.cn
Signed-off-by: David Heidelberg <david@ixit.cz>
| -rw-r--r-- | drivers/nfc/st21nfca/core.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/drivers/nfc/st21nfca/core.c b/drivers/nfc/st21nfca/core.c index 6bfeb8e7ed89..b5c1ca3acfbe 100644 --- a/drivers/nfc/st21nfca/core.c +++ b/drivers/nfc/st21nfca/core.c @@ -577,9 +577,7 @@ static int st21nfca_get_iso15693_inventory(struct nfc_hci_dev *hdev, if (r < 0) goto exit; - skb_pull(inventory_skb, 2); - - if (inventory_skb->len == 0 || + if (!skb_pull(inventory_skb, 2) || inventory_skb->len < 2 || inventory_skb->len > NFC_ISO15693_UID_MAXSIZE) { r = -EPROTO; goto exit; |