crewID/libnfc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

acr122_usb: check if received frame is long enough (Touchatag)

Browse source 
This prevents from potential out-of-memory read.
This commit is contained in:
Romuald Conty 2013-06-13 15:48:21 +02:00
parent 27c43e8b8a
commit 5757fafe0c
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
libnfc/drivers/acr122_usb.c
View file

@ -631,6 +631,11 @@ read:
goto read; goto read;
} }
} }
if (res < 12) {
log_put(LOG_GROUP, LOG_CATEGORY, NFC_LOG_PRIORITY_ERROR, "%s", "Invalid RDR_to_PC_DataBlock frame");
pnd->last_error = NFC_EIO;
return pnd->last_error;
}
if (abtRxBuf[offset] != attempted_response) { if (abtRxBuf[offset] != attempted_response) {
log_put(LOG_GROUP, LOG_CATEGORY, NFC_LOG_PRIORITY_ERROR, "%s", "Frame header mismatch"); log_put(LOG_GROUP, LOG_CATEGORY, NFC_LOG_PRIORITY_ERROR, "%s", "Frame header mismatch");
pnd->last_error = NFC_EIO; pnd->last_error = NFC_EIO;