[PATCH] nfc: digital: prevent stack buffer overflow in digital_in_recv_sensf_res()

[Syed Abdul Khaliq]

digital_in_recv_sensf_res() copies the received NFC-F SENSF_RES into the
fixed-size nfc_target.sensf_res[NFC_SENSF_RES_MAXSIZE] (18 bytes) array
with:

	memcpy(target.sensf_res, sensf_res, resp->len);

resp->len originates from the response frame returned by the peer NFC-F
device and is only lower-bounded (DIGITAL_SENSF_RES_MIN_LENGTH == 17,
checked before the leading byte is pulled). It is never upper-bounded, so
a target that returns an oversized frame makes resp->len exceed 18 after
skb_pull(), and the memcpy() writes past the end of target.sensf_res,
which lives on the stack of digital_in_recv_sensf_res(), corrupting the
stack.

The NCI ingest path already guards the same field against
NFC_SENSF_RES_MAXSIZE (see nfcf poll parsing in net/nfc/nci/ntf.c); the
NFC digital layer was missing the equivalent check. Reject frames whose
SENSF_RES portion is larger than the destination buffer.

Signed-off-by: Syed Abdul Khaliq <abdul@xxxxxxxxxxx>
---
diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c
index ae63c5eb06..bd07ec8499 100644
--- a/net/nfc/digital_technology.c
+++ b/net/nfc/digital_technology.c
@@ -774,6 +774,11 @@ static void digital_in_recv_sensf_res(struct nfc_digital_dev *ddev, void *arg,
 
 	skb_pull(resp, 1);
 
+	if (resp->len > NFC_SENSF_RES_MAXSIZE) {
+		rc = -EIO;
+		goto exit;
+	}
+
 	memset(&target, 0, sizeof(struct nfc_target));
 
 	sensf_res = (struct digital_sensf_res *)resp->data;
-- 
2.50.1 (Apple Git-155)