Re: [PATCH v2] nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

[Deepanshu Kartikey]

On Mon, Sep 21, 2026 at 4:41 AM David Heidelberg <david@xxxxxxx> wrote:
>
> On 12/09/2026 06:03, Deepanshu Kartikey wrote:
> > frame->ccid.datalen is read directly from the USB response frame
> > and used, unchecked, as an index into frame->data[]. A malicious or
> > malfunctioning device can set this field to an arbitrary value,
> > causing the driver to read far outside the received buffer.
> >
> > Bound ccid.datalen against the maximum possible ACR122 frame size
> > before using it. This replaces the existing datalen == 0 check,
> > since datalen < 2 already covers that case and additionally
> > rejects datalen == 1, which would still underflow the
> > "datalen - 2" offset used below.
> >
> > Fixes: 9815c7cf22da ("NFC: pn533: Separate physical layer from the core implementation")
> > Reported-by: syzbot+1853daab1a47603d4678@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=1853daab1a47603d4678
> > Tested-by: syzbot+1853daab1a47603d4678@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Assisted-by: Claude (Anthropic)
>
> Hello Deepanshu,
>
> thank you for the patch, could you please correct the Assisted-by tag?
>
> See: https://docs.kernel.org/process/coding-assistants.html
>
> Thanks
> David
>

Sure, I will send patch v3 shortly.

Thanks