[Fix] Issue-564: Sub-Ghz corrupts .sub files randomly after transmit#565
Open
Lechnio wants to merge 1 commit into
Open
[Fix] Issue-564: Sub-Ghz corrupts .sub files randomly after transmit#565Lechnio wants to merge 1 commit into
Lechnio wants to merge 1 commit into
Conversation
Lechnio
requested review from
956MB,
HaxSam,
MatthewKuKanich,
Sil333033 and
WillyJL
as code owners
July 11, 2026 13:50
lewisQ17
added a commit
to lewisQ17/Momentum-Firmware
that referenced
this pull request
Jul 19, 2026
…ext-Flip#443, Next-Flip#564 Memory-safety (attacker-controlled length written into fixed buffers): * EMV .nfc loader (emv.c, Next-Flip#553): bound file-supplied PAN/AID lengths and use length-checked string copies. Fixes 5 heap-overflow write sites. * EMV poller (emv_poller_i.c): the TLV decoder copied card-supplied lengths into fixed struct/stack buffers with no bounds check, reachable by tapping a crafted/emulated EMV card. Added emv_tlv_copy_clamped() and clamped every copy (AID, application label/name, cardholder name, PAN, track1/track2 stack buffers, log fields), fixed the GPO_FMT1 length underflow, bounded active_tr into trans[], and validated TLV value lengths against the response buffer in both walkers to stop over-reads. Clamps are a no-op for well-formed cards. * FeliCa loader (felica.c): reject a file whose "Blocks total" exceeds the fixed dump buffer before the read loop overflows it. * MIFARE DESFire loader (mf_desfire_i.c): bound the file-supplied access rights length to the fixed access_rights[] array. * bit_lib_get_bits (bit_lib.c, FL-3534): only read the second byte when the requested field actually crosses the byte boundary (fixes a 1-byte OOB read reachable from 300+ parser call sites; result is bit-identical). * iso15693_3_is_block_locked (iso15693_3.c): bound the index against the block-security array length for legacy/partial files. * Asset pack loader (asset_packs.c): guard the .bmx frame_size subtraction against underflow (corrupt file -> huge malloc). Bug fixes: * Next-Flip#538 NTAG21x false "password protected": only hide PWD/PACK pages when the tag is actually protected (AUTH0 < page count). AUTH0 = 0xFF (unprotected, e.g. after a set-then-clear) now reads as unlocked, matching NFC Tools. * Next-Flip#443 GuiSrv crash on bad icon: compress_icon_decode() now renders a blank icon instead of a furi_check crash when a custom asset-pack icon is malformed/oversized (built-in icons are unaffected). * SubGHz decode-RAW double-free: NULL the file-encoder worker after freeing it on a failed start so a later Back event cannot use-after-free it. * Next-Flip#564 SubGHz RAW .sub corruption after TX: gate the post-TX dynamic save-back on transmitting the internal fff_data, plus a RAW guard in subghz_save_to_file() (adopts the reviewed community fix from PR Next-Flip#565). Verified: clean release build (fbt) + updater_package (.tgz). No changes to the bootloader or radio co-processor stack. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JA9f5sJuwNgBwBNqHWsx2h
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's new
Fix for issue 564
For the reviewer