From: Jakub Kicinski <kuba@kernel.org>
To: "Lekë Hapçiu" <snowwlake@icloud.com>
Cc: netdev@vger.kernel.org, linux-wireless@vger.kernel.org,
stable@vger.kernel.org, krzysztof.kozlowski@linaro.org
Subject: Re: [PATCH net 1/4] nfc: digital: Fix stack buffer overflow in digital_in_recv_sensf_res()
Date: Sun, 12 Apr 2026 13:58:27 -0700 [thread overview]
Message-ID: <20260412135827.0cb6f44c@kernel.org> (raw)
In-Reply-To: <20260409223436.1887988-2-snowwlake@icloud.com>
On Fri, 10 Apr 2026 00:34:31 +0200 Lekë Hapçiu wrote:
> The function digital_in_recv_sensf_res() validates that the incoming
> SENSF_RES frame is at least DIGITAL_SENSF_RES_MIN_LENGTH (17) bytes,
> but does not check that it is at most NFC_SENSF_RES_MAXSIZE (18) bytes
> before copying into the 18-byte target.sensf_res stack buffer.
Hm, third similar fix we received for this.
struct digital_sensf_res is 19 bytes, you're capping the length at 18
something else is wrong here..
next prev parent reply other threads:[~2026-04-12 20:58 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-09 22:34 [PATCH net 0/4] nfc: digital: Fix missing and misplaced length checks Lekë Hapçiu
2026-04-09 22:34 ` [PATCH net 1/4] nfc: digital: Fix stack buffer overflow in digital_in_recv_sensf_res() Lekë Hapçiu
2026-04-12 20:58 ` Jakub Kicinski [this message]
2026-04-09 22:34 ` [PATCH net 2/4] nfc: digital: Fix check-after-read in digital_tg_recv_sens_req() Lekë Hapçiu
2026-04-09 22:34 ` [PATCH net 3/4] nfc: digital: Fix OOB read of RTOX byte in digital_in_recv_dep_res() Lekë Hapçiu
2026-04-09 22:34 ` [PATCH net 4/4] nfc: digital: Fix OOB read of DID byte in digital_tg_recv_dep_req() Lekë Hapçiu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260412135827.0cb6f44c@kernel.org \
--to=kuba@kernel.org \
--cc=krzysztof.kozlowski@linaro.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=snowwlake@icloud.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.