diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-15 16:43:25 +0800 |
|---|---|---|
| committer | David Heidelberg <david@ixit.cz> | 2026-08-17 19:27:50 +0200 |
| commit | 831cfb7ba99e99f4106d2e933f565c7f72bbe5c6 (patch) | |
| tree | f7a029de8053e5b8b9e0136fa5152aa78b8a739f /scripts/objdiff | |
| parent | 4108ab8dffc555a154df143d21508eb9e9658f53 (diff) | |
| download | linux-next-831cfb7ba99e99f4106d2e933f565c7f72bbe5c6.tar.gz linux-next-831cfb7ba99e99f4106d2e933f565c7f72bbe5c6.zip | |
nfc: nfcmrvl: validate helper command length before pull
The firmware download receive path removes the NCI data header and
reads the helper command before validating the remaining packet length.
A short frame can therefore reach the data access before the malformed
packet is rejected.
Validate the complete helper command length before stripping the NCI
data header.
Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715084325.40276-1-pengpeng@iscas.ac.cn
Signed-off-by: David Heidelberg <david@ixit.cz>
Diffstat (limited to 'scripts/objdiff')
0 files changed, 0 insertions, 0 deletions