#include "ndef.h" // Everything read here comes off an NFC tag that anyone can write, so every // length taken from the buffer is bounds-checked before it is used. #define NDEF_NEED(n) \ { \ if ((addr + (uint16_t)(n)) > buf_len) { \ NDEF_MSG.success = NDEF_ERR_TRUNCATED; \ return NDEF_MSG; \ } \ } ndef_message readNDEFText(unsigned char *buf, uint8_t buf_len) { uint16_t addr = 0; NDEF_MSG.success = 0; NDEF_MSG.payload_len = 0; NDEF_MSG.payload[0] = '\0'; NDEF_NEED(2); if (buf[0] != NDEF_TLV) { NDEF_MSG.success = 1; return NDEF_MSG; } if (buf[1] == 0xFF) { NDEF_MSG.success = 2; return NDEF_MSG; }; // int len_field = buf[1]; addr = 2; NDEF_NEED(3); // bool is_short_record = (buf[addr] & NDEF_SHORT_RECORD) == NDEF_SHORT_RECORD; bool has_id_length = (buf[addr] & NDEF_ID_LEN) == NDEF_ID_LEN; uint8_t tnf = buf[addr] & 0x7; addr += 1; // 3 uint8_t type_length = buf[addr]; addr += 1; // 4 uint8_t payload_length = buf[addr]; addr += 1; // 5 uint8_t id_length = 0; if (has_id_length) { NDEF_NEED(1); id_length = buf[addr]; addr += 1; } // Only the first type byte is ever inspected, so skip the rest rather than // copying them into a tag-sized VLA. NDEF_NEED(type_length); uint8_t type_value_0 = (type_length > 0) ? buf[addr] : 0; addr += type_length; if (type_value_0 != NDEF_TEXT_RECORD) { NDEF_MSG.success = 11; return NDEF_MSG; }; if (tnf != TNF_KNOWN) { NDEF_MSG.success = 12; return NDEF_MSG; }; if (has_id_length && (id_length > 0)) { NDEF_NEED(id_length); addr += id_length; } NDEF_NEED(1); uint8_t lang_str_len = buf[addr]; // payload_length covers the language-length byte plus the language code // plus the text. Subtracting without this check wraps a uint8_t to ~250. if (payload_length < ((uint16_t)lang_str_len + 1)) { NDEF_MSG.success = NDEF_ERR_BAD_LENGTH; return NDEF_MSG; } payload_length -= lang_str_len; // Language string payload_length -= 1; // The byte that says how long the language string is NDEF_NEED((uint16_t)lang_str_len + 1); addr += lang_str_len; addr += 1; // Leave room for the terminator the UART print and strchr() both rely on. if (payload_length > (sizeof(NDEF_MSG.payload) - 1)) { payload_length = sizeof(NDEF_MSG.payload) - 1; } NDEF_NEED(payload_length); for (uint8_t i = 0; i < (payload_length); i++) { NDEF_MSG.payload[i] = buf[addr]; addr += 1; } NDEF_MSG.payload[payload_length] = '\0'; NDEF_MSG.payload_len = payload_length; #if DO_UART uart_sendString(NDEF_MSG.payload); uart_sendString("\n"); #endif return NDEF_MSG; };