diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-23 10:37:20 +0800 |
|---|---|---|
| committer | David Heidelberg <david@ixit.cz> | 2026-08-17 19:27:50 +0200 |
| commit | 4108ab8dffc555a154df143d21508eb9e9658f53 (patch) | |
| tree | 76f4487696bfd9900d72afa6cee35251d0773f04 /scripts/objdiff | |
| parent | d34ea51ac1f132f6bb7902b1bcc54766774be088 (diff) | |
| download | linux-next-4108ab8dffc555a154df143d21508eb9e9658f53.tar.gz linux-next-4108ab8dffc555a154df143d21508eb9e9658f53.zip | |
nfc: microread: validate target discovery payload lengths
microread_target_discovered() parses target discovery payloads from
skb->data according to the HCI gate. The fixed field offsets and UID
copies were checked only against the destination nfc_target buffers, not
against the actual skb length.
Validate that each gate-specific payload contains the fixed fields and
UID bytes before reading or copying them.
Fixes: cfad1ba87150 ("NFC: Initial support for Inside Secure microread")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260723103508.1-microread-v2-pengpeng@iscas.ac.cn
Signed-off-by: David Heidelberg <david@ixit.cz>
Diffstat (limited to 'scripts/objdiff')
0 files changed, 0 insertions, 0 deletions