Merge pull request #435 from LedgerHQ/NFC-oob-write

fix nfc oob write
LedgerHQ · Oct 2, 2023 · e8b56c4 · e8b56c4
2 parents a7f3dd5 + 666b901
commit e8b56c4
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/src/os_io_seproxyhal.c b/src/os_io_seproxyhal.c
@@ -246,10 +246,13 @@ void io_seproxyhal_handle_capdu_event(void)
 #ifdef HAVE_NFC
 void io_seproxyhal_handle_nfc_recv_event(void)
 {
+    size_t max  = MIN(sizeof(G_io_apdu_buffer), sizeof(G_io_seproxyhal_spi_buffer) - 3);
+    size_t size = U2BE(G_io_seproxyhal_spi_buffer, 1);
+
     G_io_app.apdu_media  = IO_APDU_MEDIA_NFC;
     G_io_app.apdu_state  = APDU_NFC;
-    G_io_app.apdu_length = ((G_io_seproxyhal_spi_buffer[1] << 8) & 0xFF00)
-                           | (G_io_seproxyhal_spi_buffer[2] & 0x00FF);
+    G_io_app.apdu_length = MIN(size, max);
+
     memcpy(G_io_apdu_buffer, &G_io_seproxyhal_spi_buffer[3], G_io_app.apdu_length);
 }
 #endif