Pengpeng Hou 686f942332 nfc: nfcmrvl: validate helper command length before pull ...

The firmware download receive path removes the NCI data header and
reads the helper command before validating the remaining packet length.
A short frame can therefore reach the data access before the malformed
packet is rejected.

Validate the complete helper command length before stripping the NCI
data header.

Fixes: 3194c68701 ("NFC: nfcmrvl: add firmware download support")
Signed-off-by: Pengpeng Hou <[email protected]>
Link: https://patch.msgid.link/[email protected]
Signed-off-by: David Heidelberg <[email protected]>

2026-09-23 22:13:15 +02:00

..

fw_dnld.c

nfc: nfcmrvl: validate helper command length before pull

2026-09-23 22:13:15 +02:00

fw_dnld.h

…

i2c.c

nfc: Unify style of of_device_id arrays

2026-08-11 18:14:00 +02:00

Kconfig

…

main.c

nfc: nfcmrvl: convert to gpio descriptors

2026-03-09 10:25:34 +01:00

Makefile

…

nfcmrvl.h

nfc: nfcmrvl: convert to gpio descriptors

2026-03-09 10:25:34 +01:00

spi.c

nfc: Initialize spi_device_idarrays using member names

2026-08-11 18:14:00 +02:00

uart.c

nfc: nfcmrvl: convert to gpio descriptors

2026-03-09 10:25:34 +01:00

usb.c

nfc: Unify style of usb_device_id arrays

2026-08-11 18:14:01 +02:00