diff options
| author | Ömer Mete Kaya <omermetekaya0@gmail.com> | 2026-09-09 15:14:31 +0300 |
|---|---|---|
| committer | David Heidelberg <david@ixit.cz> | 2026-09-23 22:13:17 +0200 |
| commit | 408cff6bd60636df201274d320edfdfde9ed41db (patch) | |
| tree | 588fb1900d8412f842fa7c764737ee6dd1a03c0f /net | |
| parent | c04981e42d94f39c1dba965cc462a046e946a6c5 (diff) | |
nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
nfc_llcp_wks_sap() compares only service_name_len bytes, so a short
service_name like "u" matches longer WKS strings like "urn:nfc:sn:snep".
Fix by requiring exact length match before strncmp().
Fixes: d646960f7986 ("NFC: Initial LLCP support")
Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
Link: https://patch.msgid.link/20260909121437.33744-1-omermetekaya0@gmail.com
Signed-off-by: David Heidelberg <david@ixit.cz>
Diffstat (limited to 'net')
| -rw-r--r-- | net/nfc/llcp_core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c index 5ce3ce64baf2..def712e1b2b2 100644 --- a/net/nfc/llcp_core.c +++ b/net/nfc/llcp_core.c @@ -369,7 +369,8 @@ static int nfc_llcp_wks_sap(const char *service_name, size_t service_name_len) if (wks[sap] == NULL) continue; - if (strncmp(wks[sap], service_name, service_name_len) == 0) + if (strlen(wks[sap]) == service_name_len && + !strncmp(wks[sap], service_name, service_name_len)) return sap; } |