diff options
Diffstat (limited to 'drivers/nfc/st21nfca')
| -rw-r--r-- | drivers/nfc/st21nfca/st21nfca.c | 4 | ||||
| -rw-r--r-- | drivers/nfc/st21nfca/st21nfca_se.c | 11 |
2 files changed, 12 insertions, 3 deletions
diff --git a/drivers/nfc/st21nfca/st21nfca.c b/drivers/nfc/st21nfca/st21nfca.c index 24d3d240d5f4..d251f7229c4e 100644 --- a/drivers/nfc/st21nfca/st21nfca.c +++ b/drivers/nfc/st21nfca/st21nfca.c @@ -572,7 +572,7 @@ exit: return r; } -static int st21nfca_get_iso14443_3_uid(struct nfc_hci_dev *hdev, u8 *gate, +static int st21nfca_get_iso14443_3_uid(struct nfc_hci_dev *hdev, u8 *uid, int *len) { int r; @@ -588,7 +588,7 @@ static int st21nfca_get_iso14443_3_uid(struct nfc_hci_dev *hdev, u8 *gate, goto exit; } - gate = uid_skb->data; + memcpy(uid, uid_skb->data, uid_skb->len); *len = uid_skb->len; exit: kfree_skb(uid_skb); diff --git a/drivers/nfc/st21nfca/st21nfca_se.c b/drivers/nfc/st21nfca/st21nfca_se.c index bd13cac9c66a..3197e9bb66f7 100644 --- a/drivers/nfc/st21nfca/st21nfca_se.c +++ b/drivers/nfc/st21nfca/st21nfca_se.c @@ -310,6 +310,13 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, case ST21NFCA_EVT_CONNECTIVITY: break; case ST21NFCA_EVT_TRANSACTION: + /* + * According to specification etsi 102 622 + * 11.2.2.4 EVT_TRANSACTION Table 52 + * Description Tag Length + * AID 81 5 to 16 + * PARAMETERS 82 0 to 255 + */ if (skb->len < NFC_MIN_AID_LENGTH + 2 && skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG) return -EPROTO; @@ -318,8 +325,10 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, skb->len - 2, GFP_KERNEL); transaction->aid_len = skb->data[1]; - memcpy(transaction->aid, &skb->data[2], skb->data[1]); + memcpy(transaction->aid, &skb->data[2], + transaction->aid_len); + /* Check next byte is PARAMETERS tag (82) */ if (skb->data[transaction->aid_len + 2] != NFC_EVT_TRANSACTION_PARAMS_TAG) return -EPROTO; |