Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Deepanshu Kartikey b61732f473 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() ... frame->ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame->data[]. A malicious or malfunctioning device can set this field to an arbitrary value, causing the driver to read far outside the received buffer. Bound ccid.datalen against the maximum possible ACR122 frame size before using it. This replaces the existing datalen == 0 check, since datalen < 2 already covers that case and additionally rejects datalen == 1, which would still underflow the "datalen - 2" offset used below. Fixes: 9815c7cf22 ("NFC: pn533: Separate physical layer from the core implementation") Reported-by: syzbot+1853daab1a47603d4678@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1853daab1a47603d4678 Tested-by: syzbot+1853daab1a47603d4678@syzkaller.appspotmail.com Assisted-by: LLM Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> Link: https://patch.msgid.link/20260923035627.6210-1-kartikey406@gmail.com Signed-off-by: David Heidelberg <david@ixit.cz>		History 2026-09-23 22:13:18 +02:00
..
i2c.c	nfc: Unify style of of_device_id arrays	2026-08-11 18:14:00 +02:00
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile	nfc: pn533: add UART phy driver	2019-10-29 21:05:26 -07:00
pn533.c	nfc: fix use-after-free in nfc_get_local_general_bytes	2026-09-23 22:13:17 +02:00
pn533.h	nfc: fix use-after-free in nfc_get_local_general_bytes	2026-09-23 22:13:17 +02:00
uart.c	nfc: Unify style of of_device_id arrays	2026-08-11 18:14:00 +02:00
usb.c	nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()	2026-09-23 22:13:18 +02:00