From 028f3b6bf5fb475e965b946fec5c2d0de982588f Mon Sep 17 00:00:00 2001 From: Eric Wild Date: Tue, 28 Jul 2026 17:42:32 +0200 Subject: [PATCH] firmware: sniffer: do not drop maximum-length ATRs 7816-3 8.1/8.2.1 allow TS plus 32 bytes. atr_i is a byte count, not an index, process_byte_atr() guards its own store with the same condition before incrementing, so atr_i reaches 33. Change-Id: Ic8398cbefc0b522946b6470fd0268fa70662dab1 --- firmware/libcommon/source/sniffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/firmware/libcommon/source/sniffer.c b/firmware/libcommon/source/sniffer.c index 419e8fb3..98cc6cd8 100644 --- a/firmware/libcommon/source/sniffer.c +++ b/firmware/libcommon/source/sniffer.c @@ -406,7 +406,7 @@ static void usb_send_atr(uint32_t flags) TRACE_WARNING("Can't print ATR in ISO 7816-3 state %u\n\r", iso_state); return; } - if (g_atr.atr_i >= ARRAY_SIZE(g_atr.atr)) { + if (g_atr.atr_i > ARRAY_SIZE(g_atr.atr)) { TRACE_ERROR("ATR buffer overflow\n\r"); return; }