Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-08-01 20:28:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

drivers/contactless: fix uninitialized uid leak in mfrc522_read

Browse source 
Fix security issue where uninitialized kernel stack contents could be
leaked to userspace when mfrc522_picc_select() fails.

In mfrc522_read(), the local variable 'uid' was not initialized before
being passed to mfrc522_picc_select(). If the function fails (e.g., due
to bad data on the SPI bus), the uninitialized uid.sak value could pass
the PICC_TYPE_NOT_COMPLETE check, causing snprintf() to copy
uninitialized kernel stack data to the userspace buffer.

Fixes #19417

Signed-off-by: hanzhijian <hanzhijian@zepp.com>
Author: hanzhijian <hanzhijian@zepp.com>
This commit is contained in:
hanzhijian 2026-07-13 09:43:11 +08:00 • committed by Xiang Xiao
parent 8d2b71d127
commit 20579ab531
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
drivers/contactless/mfrc522.c
View file

@ -1480,6 +1480,7 @@ static ssize_t mfrc522_read(FAR struct file *filep, FAR char *buffer,
FAR struct inode *inode;
FAR struct mfrc522_dev_s *dev;
FAR struct picc_uid_s uid;
int ret;
inode = filep->f_inode;
@ -1496,7 +1497,13 @@ static ssize_t mfrc522_read(FAR struct file *filep, FAR char *buffer,
/* Now read the UID */
mfrc522_picc_select(dev, &uid, 0);
memset(&uid, 0, sizeof(uid));
ret = mfrc522_picc_select(dev, &uid, 0);
if (ret < 0)
{
ctlserr("Failed to select PICC: %d\n", ret);
return ret;
}
if (uid.sak != PICC_TYPE_NOT_COMPLETE)
{