Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-08-21 13:38:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

drivers/contactless/pn532: Fix Stack Overflow in PN532 Contactless Driver

Browse source 
When calling Set RF Configuration command, a compromised user
process can trigger memory corruption in the kernel. This can
lead to a system crash or potentially arbitrary code execution
in the kernel.

It addresses an earlier incomplete fix.

Tested locally.

Signed-off-by: Your Name <catalin_visinescu@yahoo.com>
This commit is contained in:
Catalin Visinescu 2026-06-13 09:33:52 -04:00 • committed by Xiang Xiao
parent 269cc0dc15
commit d33e20fa1c
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
drivers/contactless/pn532.c
View file

@ -788,13 +788,18 @@ static int pn532_read_passive_target(FAR struct pn532_dev_s *dev,
bool pn532_set_rf_config(struct pn532_dev_s * dev,
struct pn_rf_config_s * conf)
{
/* cmd_buffer is sizeof(pn532_frame) + up to 16 bytes data */
bool res = false;
uint8_t cmd_buffer[15 + 7];
uint8_t cmd_buffer[6 + 16];
FAR struct pn532_frame *f = (FAR struct pn532_frame *) cmd_buffer;
pn532_frame_init(f, PN532_COMMAND_RFCONFIGURATION);
f->data[1] = conf->cfg_item;
DEBUGASSERT(conf->data_size <= 16);
/* only copy 16 bytes minus 1 byte for each: cmd and cfg_item */
DEBUGASSERT(conf->data_size <= 16 - 2);
memcpy(&f->data[2], conf->config, conf->data_size);
f->len += conf->data_size + 1;
pn532_frame_finish(f);