github/esphome
2
0
Fork 0
mirror of https://github.com/esphome/esphome.git synced 2026-09-18 18:48:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

[nfc] Fix off-by-one in NDEF message parsing (#14485)

Browse Source 
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Jonathan Swoboda
2026-03-05 09:55:54 -10:00
committed by GitHub
co-authored by Claude Opus 4.6
parent 99a805cba6
commit 291679126f
1 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
esphome/components/nfc/ndef_message.cpp
+16 -2
View File
@@ -8,8 +8,14 @@ static const char *const TAG = "nfc.ndef_message";
NdefMessage::NdefMessage(std::vector<uint8_t> &data) {
ESP_LOGV(TAG, "Building NdefMessage with %zu bytes", data.size());
uint8_t index = 0;
while (index <= data.size()) {
size_t index = 0;
while (index < data.size()) {
// Minimum record: TNF byte + type length byte + payload length (1 or 4 bytes)
if (index + 2 >= data.size()) {
ESP_LOGE(TAG, "Truncated record header; aborting");
break;
}
uint8_t tnf_byte = data[index++];
bool me = tnf_byte & 0x40; // Message End bit (is set if this is the last record of the message)
bool sr = tnf_byte & 0x10; // Short record bit (is set if payload size is less or equal to 255 bytes)
@@ -23,6 +29,10 @@ NdefMessage::NdefMessage(std::vector<uint8_t> &data) {
if (sr) {
payload_length = data[index++];
} else {
if (index + 4 > data.size()) {
ESP_LOGE(TAG, "Truncated payload length; aborting");
break;
}
payload_length = (static_cast<uint32_t>(data[index]) << 24) | (static_cast<uint32_t>(data[index + 1]) << 16) |
(static_cast<uint32_t>(data[index + 2]) << 8) | static_cast<uint32_t>(data[index + 3]);
index += 4;
@@ -30,6 +40,10 @@ NdefMessage::NdefMessage(std::vector<uint8_t> &data) {
uint8_t id_length = 0;
if (il) {
if (index >= data.size()) {
ESP_LOGE(TAG, "Truncated ID length; aborting");
break;
}
id_length = data[index++];
}