diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-15 16:43:25 +0800 |
|---|---|---|
| committer | David Heidelberg <david@ixit.cz> | 2026-09-23 22:13:15 +0200 |
| commit | 686f942332b1667f13f3b8d6a2f50bcfbf42e277 (patch) | |
| tree | c3f84715143cab31b0909c688100d5e70e1c165a /tools/perf/scripts/python | |
| parent | fd73f4a6659897191fa0d40695fe370925dd3780 (diff) | |
nfc: nfcmrvl: validate helper command length before pull
The firmware download receive path removes the NCI data header and
reads the helper command before validating the remaining packet length.
A short frame can therefore reach the data access before the malformed
packet is rejected.
Validate the complete helper command length before stripping the NCI
data header.
Fixes: 3194c6870158 ("NFC: nfcmrvl: add firmware download support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260715084325.40276-1-pengpeng@iscas.ac.cn
Signed-off-by: David Heidelberg <david@ixit.cz>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions