arno/trezor-firmware
1
0
Fork 0
mirror of https://github.com/trezor/trezor-firmware.git synced 2025-03-13 14:46:06 +00:00
Code Issues Releases Wiki Activity

fix(core): Fix ndef uri buffer handling

Browse Source
This commit is contained in:
kopecdav 2025-02-07 14:30:21 +01:00
parent bd5de3ab87
commit 9ca4e03843
3 changed files with 37 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
core/embed/io/nfc/st25r3916b/ndef.c
View File

@ -20,7 +20,8 @@
#include <trezor_rtl.h>
#include "ndef.h"
// ndef_status_t create_ndef_record_uri(uint8_t *bytearray, )
#define NDEF_MESSAGE_URI_OVERHEAD 7
ndef_status_t ndef_parse_message(const uint8_t *buffer, uint16_t buffer_len,
ndef_message_t *message) {
@ -107,8 +108,7 @@ ndef_status_t ndef_parse_record(const uint8_t *buffer, uint16_t len,
}
// Look at first byte, parse header
memcpy(&rec->header, buffer, 1);
bp++;
rec->header.byte = buffer[bp++];
if (rec->header.tnf == 0x00 || rec->header.tnf > 0x06) {
return NDEF_ERROR; // Empty or non-existing record
@ -119,7 +119,7 @@ ndef_status_t ndef_parse_record(const uint8_t *buffer, uint16_t len,
if (rec->header.sr) {
rec->payload_length = buffer[bp++];
} else {
memcpy(&rec->payload_length, buffer + bp, 4);
rec->payload_length = (uint32_t) buffer[bp];
bp += 4;
}
@ -131,22 +131,26 @@ ndef_status_t ndef_parse_record(const uint8_t *buffer, uint16_t len,
}
if (rec->type_length > 0) {
memcpy(&rec->type, buffer + bp, rec->type_length);
rec->type = buffer[bp];
bp += rec->type_length;
} else {
// Type length ommited
rec->type = 0;
}
if (rec->id_length > 0) {
memcpy(&rec->id, buffer + bp, rec->id_length);
bp += rec->id_length;
} else {
// ID length ommited
if (rec->id_length == 0) {
// ID ommited
rec->id = 0;
}else{
rec->id = buffer[bp++];
}
if (rec->payload_length > 0) {
if (rec->payload_length > NDEF_MAX_RECORD_PAYLOAD_BYTES) {
return NDEF_ERROR; // Payload too long
}
memcpy(rec->payload, buffer + bp, rec->payload_length);
bp += rec->payload_length;
} else {
@ -158,12 +162,18 @@ ndef_status_t ndef_parse_record(const uint8_t *buffer, uint16_t len,
return NDEF_OK;
}
uint16_t ndef_create_uri(const char *uri, uint8_t *buffer) {
*buffer = 0x3; // TLV header
buffer++;
uint16_t ndef_create_uri(const char *uri, uint8_t *buffer, size_t buffer_size) {
uint16_t uri_len = strlen(uri);
if(buffer_size < (uri_len + NDEF_MESSAGE_URI_OVERHEAD)){
return 0; // Not enough room to create URI
}
*buffer = 0x3; // TLV header
buffer++;
// NDEF message length
*buffer = uri_len + 5; // uri + record header;
buffer++;

20
core/embed/io/nfc/st25r3916b/ndef.h
View File

@ -30,12 +30,17 @@ typedef enum {
} ndef_status_t;
typedef struct {
uint8_t tnf : 3;
uint8_t il : 1;
uint8_t sr : 1;
uint8_t cf : 1;
uint8_t me : 1;
uint8_t mb : 1;
union{
struct {
uint8_t mb : 1;
uint8_t me : 1;
uint8_t cf : 1;
uint8_t sr : 1;
uint8_t il : 1;
uint8_t tnf : 3;
};
uint8_t byte;
};
} ndef_record_header_t;
typedef struct {
@ -59,5 +64,6 @@ ndef_status_t ndef_parse_message(const uint8_t *buffer, uint16_t buffer_len,
ndef_message_t *message);
ndef_status_t ndef_parse_record(const uint8_t *buffer, uint16_t len,
ndef_record_t *rec);
uint16_t ndef_create_uri(const char *uri, uint8_t *buffer);
uint16_t ndef_create_uri(const char *uri, uint8_t *buffer, size_t buffer_size);

2
core/embed/io/nfc/st25r3916b/nfc.c
View File

@ -495,7 +495,7 @@ nfc_status_t nfc_dev_write_ndef_uri(void) {
// NDEF message
uint8_t ndef_message[128] = {0};
uint16_t buffer_len = ndef_create_uri("trezor.io/", ndef_message);
uint16_t buffer_len = ndef_create_uri("trezor.io/", ndef_message, sizeof(ndef_message));
for (uint8_t i = 0; i < buffer_len / 4; i++) {
rfalT2TPollerWrite(4 + i, ndef_message + i * 4);