nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
authorJordy Zomer <jordy@pwning.systems>
Tue, 11 Jan 2022 16:44:51 +0000 (17:44 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 28 Mar 2022 07:58:42 +0000 (09:58 +0200)
commita34c47b1ab07153a047476de83581dc822287f39
tree526ef93468c304a72dc874cda435377f9c9960df
parent96e48ac9a685f2f5855e2820496ed6ecf893febe
nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION

commit 4fbcc1a4cb20fe26ad0225679c536c80f1648221 upstream.

It appears that there are some buffer overflows in EVT_TRANSACTION.
This happens because the length parameters that are passed to memcpy
come directly from skb->data and are not guarded in any way.

Signed-off-by: Jordy Zomer <jordy@pwning.systems>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Denis Efremov <denis.e.efremov@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/nfc/st21nfca/se.c