From cf0c2dd9f2a30f92c76f8095631caefafe51ee5a Mon Sep 17 00:00:00 2001
From: Romuald Conty <romuald@libnfc.org>
Date: Tue, 18 May 2010 10:55:18 +0000
Subject: [PATCH] Fix ATS lenght in pn53x_decode_target_data().

---
 libnfc/chips/pn53x.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libnfc/chips/pn53x.c b/libnfc/chips/pn53x.c
index 8d28cd1..5e6d91d 100644
--- a/libnfc/chips/pn53x.c
+++ b/libnfc/chips/pn53x.c
@@ -243,7 +243,8 @@ pn53x_decode_target_data(const byte_t* pbtRawData, size_t szDataLen, nfc_chip_t
   switch(ntt) {
     case NTT_MIFARE:
     case NTT_GENERIC_PASSIVE_106:
-      // We skip target number (Tg)
+      // We skip the first byte: its the target number (Tg)
+
       pbtRawData++;
       // Somehow they switched the lower and upper ATQA bytes around for the PN531 chipset
       if (nc == NC_PN531) {
@@ -261,7 +262,7 @@ pn53x_decode_target_data(const byte_t* pbtRawData, size_t szDataLen, nfc_chip_t
       
       // Did we received an optional ATS (Smardcard ATR)
       if (szDataLen > (pnti->nai.szUidLen + 5)) {
-	pnti->nai.szAtsLen = *(pbtRawData++);
+	pnti->nai.szAtsLen = ((*(pbtRawData++)) - 1); // In pbtRawData, ATS Length byte is counted in ATS Frame.
 	memcpy(pnti->nai.abtAts, pbtRawData, pnti->nai.szAtsLen);
       } else {
 	pnti->nai.szAtsLen = 0;