Dan Carpenter 12f24af88f nfc: pn533: prevent potential memory corruption ...

[ Upstream commit ca4d4c34ae ]

If the "type_a->nfcid_len" is too large then it would lead to memory
corruption in pn533_target_found_type_a() when we do:

	memcpy(nfc_tgt->nfcid1, tgt_type_a->nfcid_data, nfc_tgt->nfcid1_len);

Fixes: c3b1e1e8a7 ("NFC: Export NFCID1 from pn533")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-05-16 11:02:54 +09:00

..

i2c.c

NFC: pn533: change order of free_irq and dev unregistration

2018-03-22 09:17:46 +01:00

Kconfig

NFC: pn533: add I2C phy driver

2016-04-09 23:53:20 +02:00

Makefile

NFC: pn533: add I2C phy driver

2016-04-09 23:53:20 +02:00

pn533.c

nfc: pn533: prevent potential memory corruption

2023-05-16 11:02:54 +09:00

pn533.h

NFC: pn533: fix order of initialization

2016-05-09 23:59:18 +02:00

usb.c

NFC: pn533: Fix wrong GFP flag usage

2023-05-12 17:05:02 +09:00