nfc: nfcmrvl: validate helper command length before pull

Browse source

The firmware download receive path removes the NCI data header and
reads the helper command before validating the remaining packet length.
A short frame can therefore reach the data access before the malformed
packet is rejected.

Validate the complete helper command length before stripping the NCI
data header.

Fixes: 3194c68701 ("NFC: nfcmrvl: add firmware download support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715084325.40276-1-pengpeng@iscas.ac.cn
Signed-off-by: David Heidelberg <david@ixit.cz>

...

This commit is contained in:

Pengpeng Hou 2026-07-15 16:43:25 +08:00 • committed by David Heidelberg

parent fd73f4a665

commit 686f942332

No known key found for this signature in database

GPG key ID: 60023FC4D3492072

1 changed files with 8 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

11

drivers/nfc/nfcmrvl/fw_dnld.c

View file