diff options
| author | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2014-10-11 11:34:07 -0700 |
|---|---|---|
| committer | Dmitry Torokhov <dmitry.torokhov@gmail.com> | 2014-10-11 11:34:07 -0700 |
| commit | 9d93551188069a0a21e664b4bfc89ed4a6df1903 (patch) | |
| tree | bcf7334c0e57323a6844b8147ce1c92180fe8cef /drivers/nfc/microread/microread.c | |
| parent | dd4cae8bf16611053ee7b00e20aa4fa945b92b99 (diff) | |
| parent | bfe01a5ba2490f299e1d2d5508cbbbadd897bbe9 (diff) | |
| download | blackbird-obmc-linux-9d93551188069a0a21e664b4bfc89ed4a6df1903.tar.gz blackbird-obmc-linux-9d93551188069a0a21e664b4bfc89ed4a6df1903.zip | |
Merge tag 'v3.17' into next
Synchronize with mainline to bring in changes to Synaptics and i8042
drivers.
Diffstat (limited to 'drivers/nfc/microread/microread.c')
| -rw-r--r-- | drivers/nfc/microread/microread.c | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/drivers/nfc/microread/microread.c b/drivers/nfc/microread/microread.c index f868333271aa..963a4a5dc88e 100644 --- a/drivers/nfc/microread/microread.c +++ b/drivers/nfc/microread/microread.c @@ -501,9 +501,13 @@ static void microread_target_discovered(struct nfc_hci_dev *hdev, u8 gate, targets->sens_res = be16_to_cpu(*(u16 *)&skb->data[MICROREAD_EMCF_A_ATQA]); targets->sel_res = skb->data[MICROREAD_EMCF_A_SAK]; - memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A_UID], - skb->data[MICROREAD_EMCF_A_LEN]); targets->nfcid1_len = skb->data[MICROREAD_EMCF_A_LEN]; + if (targets->nfcid1_len > sizeof(targets->nfcid1)) { + r = -EINVAL; + goto exit_free; + } + memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A_UID], + targets->nfcid1_len); break; case MICROREAD_GATE_ID_MREAD_ISO_A_3: targets->supported_protocols = @@ -511,9 +515,13 @@ static void microread_target_discovered(struct nfc_hci_dev *hdev, u8 gate, targets->sens_res = be16_to_cpu(*(u16 *)&skb->data[MICROREAD_EMCF_A3_ATQA]); targets->sel_res = skb->data[MICROREAD_EMCF_A3_SAK]; - memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A3_UID], - skb->data[MICROREAD_EMCF_A3_LEN]); targets->nfcid1_len = skb->data[MICROREAD_EMCF_A3_LEN]; + if (targets->nfcid1_len > sizeof(targets->nfcid1)) { + r = -EINVAL; + goto exit_free; + } + memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A3_UID], + targets->nfcid1_len); break; case MICROREAD_GATE_ID_MREAD_ISO_B: targets->supported_protocols = NFC_PROTO_ISO14443_B_MASK; |
