diff options
| author | Samuel Ortiz <sameo@linux.intel.com> | 2013-11-25 00:24:00 +0100 |
|---|---|---|
| committer | Samuel Ortiz <sameo@linux.intel.com> | 2013-11-25 00:28:28 +0100 |
| commit | 3621fe2a2143cc47a81954c3a80920bb8adb71a4 (patch) | |
| tree | 73a59dc94a600a2e46d02d5fd76c5a943835c747 | |
| parent | 60f82868a2a1acb5d0ebb1b68dcb96aeb289a32d (diff) | |
| download | neard-3621fe2a2143cc47a81954c3a80920bb8adb71a4.tar.gz neard-3621fe2a2143cc47a81954c3a80920bb8adb71a4.tar.bz2 neard-3621fe2a2143cc47a81954c3a80920bb8adb71a4.zip | |
nfctype1: Check for remaining space before memcpy'ing data
Code review done by Sebastian Krahmer <krahmer@suse.de>.
| -rw-r--r-- | plugins/nfctype1.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/plugins/nfctype1.c b/plugins/nfctype1.c index e2cb93b..5e2d95a 100644 --- a/plugins/nfctype1.c +++ b/plugins/nfctype1.c @@ -159,6 +159,11 @@ static int data_recv(uint8_t *resp, int length, void *data) /* Add data to tag mem */ tagdata = near_tag_get_data(t1_tag->tag, &data_length); + + /* Check that we have enough free space */ + if (data_length - t1_tag->data_read < (uint)length) + return -EINVAL; + memcpy(tagdata + t1_tag->data_read, resp + 1, length); /* Next segment */ |