nci_core_init_rsp_packet_v1() and nci_core_init_rsp_packet_v2() cast skb->data to response structures and dereference fields without first checking that skb->len is large enough. A malicious or malformed NFCC can send a short response packet, causing an out-of-bounds read. Add minimum length checks at the start of both functions. For v1, check that at least sizeof(nci_core_init_rsp_1) bytes are available before accessing rsp_1 fields, and validate the dynamic offset before accessing rsp_2. For v2, check that at least sizeof(nci_core_init_rsp_nci_ver2) bytes are available. Signed-off-by: Dudu Lu --- net/nfc/nci/rsp.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/net/nfc/nci/rsp.c b/net/nfc/nci/rsp.c index 9eeb862825c5..01972c806b45 100644 --- a/net/nfc/nci/rsp.c +++ b/net/nfc/nci/rsp.c @@ -1,3 +1,14 @@ + if (skb->len < sizeof(*rsp)) { + pr_err("short NCI_CORE_INIT_RSP v2 packet\n"); + return NCI_STATUS_SYNTAX_ERROR; + } + if (skb->len < 6 + rsp_1->num_supported_rf_interfaces + + sizeof(*rsp_2)) { + pr_err("short NCI_CORE_INIT_RSP v1 packet\n"); + return NCI_STATUS_SYNTAX_ERROR; + } + if (skb->len < sizeof(*rsp_1)) + return NCI_STATUS_SYNTAX_ERROR; // SPDX-License-Identifier: GPL-2.0-only /* * The NFC Controller Interface is the communication protocol between an -- 2.39.3 (Apple Git-145)