From ea87a5efa9efa84cd48fbf7a969d951b32c9e5e4 Mon Sep 17 00:00:00 2001 From: Samuel Ortiz Date: Sat, 4 Jan 2014 03:23:35 +0100 Subject: NFC: pn533: Frame is invalid if ccid.datalen is 0 Some ACR122 firmwares seem to send 0 length data frames. Before using that length as a data index, we check that it's not 0. If it is we report the frame as being invalid. Reported-by: Arthur Taylor Signed-off-by: Samuel Ortiz --- drivers/nfc/pn533.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers/nfc/pn533.c') diff --git a/drivers/nfc/pn533.c b/drivers/nfc/pn533.c index 3df19e657bc1..cf1a87bb74f8 100644 --- a/drivers/nfc/pn533.c +++ b/drivers/nfc/pn533.c @@ -521,6 +521,9 @@ static bool pn533_acr122_is_rx_frame_valid(void *_frame, struct pn533 *dev) if (frame->ccid.type != 0x83) return false; + if (!frame->ccid.datalen) + return false; + if (frame->data[frame->ccid.datalen - 2] == 0x63) return false; -- cgit v1.2.3