Unverified Commit 7b2baa68 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12627 NFC: nci: Bounds check struct nfc_target arrays 

Merge Pull Request from: @ci-robot 
 
PR sync from: Bowen You <youbowen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/3CZPSPM4ASLZCRE5EG36YC4DHOBIDYRD/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYRFA 
 
Link:https://gitee.com/openeuler/kernel/pulls/12627

 

Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 0723cffd d2c5c7a0

net/nfc/nci/ntf.c

+6 −0
Original line number Diff line number Diff line
@@ -230,6 +230,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, 
		target->sens_res = nfca_poll->sens_res;

		target->sel_res = nfca_poll->sel_res;

		target->nfcid1_len = nfca_poll->nfcid1_len;

		if (target->nfcid1_len > ARRAY_SIZE(target->nfcid1))

			return -EPROTO;

		if (target->nfcid1_len > 0) {

			memcpy(target->nfcid1, nfca_poll->nfcid1,

			       target->nfcid1_len);
@@ -238,6 +240,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, 
		nfcb_poll = (struct rf_tech_specific_params_nfcb_poll *)params;



		target->sensb_res_len = nfcb_poll->sensb_res_len;

		if (target->sensb_res_len > ARRAY_SIZE(target->sensb_res))

			return -EPROTO;

		if (target->sensb_res_len > 0) {

			memcpy(target->sensb_res, nfcb_poll->sensb_res,

			       target->sensb_res_len);
@@ -246,6 +250,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, 
		nfcf_poll = (struct rf_tech_specific_params_nfcf_poll *)params;



		target->sensf_res_len = nfcf_poll->sensf_res_len;

		if (target->sensf_res_len > ARRAY_SIZE(target->sensf_res))

			return -EPROTO;

		if (target->sensf_res_len > 0) {

			memcpy(target->sensf_res, nfcf_poll->sensf_res,

			       target->sensf_res_len);