Unverified Commit 979b07fa authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12622 NFC: nci: Bounds check struct nfc_target arrays 

Merge Pull Request from: @ci-robot 
 
PR sync from: Bowen You <youbowen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/VR7TUCGZWP4OHV7ABKY2I65YPO2675AH/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYRFA 
 
Link:https://gitee.com/openeuler/kernel/pulls/12622

 

Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 2bd29774 b37b69af

net/nfc/nci/ntf.c

+6 −0
Original line number Diff line number Diff line
@@ -218,6 +218,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, 
		target->sens_res = nfca_poll->sens_res;

		target->sel_res = nfca_poll->sel_res;

		target->nfcid1_len = nfca_poll->nfcid1_len;

		if (target->nfcid1_len > ARRAY_SIZE(target->nfcid1))

			return -EPROTO;

		if (target->nfcid1_len > 0) {

			memcpy(target->nfcid1, nfca_poll->nfcid1,

			       target->nfcid1_len);
@@ -226,6 +228,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, 
		nfcb_poll = (struct rf_tech_specific_params_nfcb_poll *)params;



		target->sensb_res_len = nfcb_poll->sensb_res_len;

		if (target->sensb_res_len > ARRAY_SIZE(target->sensb_res))

			return -EPROTO;

		if (target->sensb_res_len > 0) {

			memcpy(target->sensb_res, nfcb_poll->sensb_res,

			       target->sensb_res_len);
@@ -234,6 +238,8 @@ static int nci_add_new_protocol(struct nci_dev *ndev, 
		nfcf_poll = (struct rf_tech_specific_params_nfcf_poll *)params;



		target->sensf_res_len = nfcf_poll->sensf_res_len;

		if (target->sensf_res_len > ARRAY_SIZE(target->sensf_res))

			return -EPROTO;

		if (target->sensf_res_len > 0) {

			memcpy(target->sensf_res, nfcf_poll->sensf_res,

			       target->sensf_res_len);