github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-26 10:02:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()

Browse Source 
nfc_llcp_wks_sap() compares only service_name_len bytes, so a short
service_name like "u" matches longer WKS strings like "urn:nfc:sn:snep".
Fix by requiring exact length match before strncmp().

Fixes: d646960f79 ("NFC: Initial LLCP support")
Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
Link: https://patch.msgid.link/20260909121437.33744-1-omermetekaya0@gmail.com
Signed-off-by: David Heidelberg <david@ixit.cz>
This commit is contained in:
Ömer Mete Kaya 2026-09-09 15:14:31 +03:00 committed by David Heidelberg
parent c04981e42d
commit 408cff6bd6
No known key found for this signature in database
GPG Key ID: 60023FC4D3492072
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
net/nfc/llcp_core.c
View File

@ -369,7 +369,8 @@ static int nfc_llcp_wks_sap(const char *service_name, size_t service_name_len)
if (wks[sap] == NULL)
continue;
if (strncmp(wks[sap], service_name, service_name_len) == 0)
if (strlen(wks[sap]) == service_name_len &&
!strncmp(wks[sap], service_name, service_name_len))
return sap;
}