From 84894eabd2db8ca07ddab38b2fa76d75fa1a8755 Mon Sep 17 00:00:00 2001
From: Eric Betts <bettse@fastmail.fm>
Date: Mon, 3 Nov 2025 20:55:07 -0800
Subject: [PATCH] Check number of bytes on wire vs length expected

---
 t_1.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/t_1.c b/t_1.c
index 4ae2908..14ecf75 100644
--- a/t_1.c
+++ b/t_1.c
@@ -198,8 +198,13 @@ bool seader_recv_t1(Seader* seader, CCID_Message* message) {
     uint8_t NAD = message->payload[0];
     uint8_t rPCB = message->payload[1];
     uint8_t LEN = message->payload[2];
-    uint8_t LRC = message->payload[3 + LEN];
-    FURI_LOG_D(TAG, "NAD: %02X, rPCB: %02X, LEN: %02X, LRC: %02X", NAD, rPCB, LEN, LRC);
+    //uint8_t LRC = message->payload[3 + LEN];
+    //FURI_LOG_D(TAG, "NAD: %02X, rPCB: %02X, LEN: %02X, LRC: %02X", NAD, rPCB, LEN, LRC);
+
+    if(message->dwLength < (uint32_t)(3 + LEN + 1)) {
+        // incomplete frame
+        return false;
+    }
 
     if(rPCB == 0xE1) {
         // S(IFS response)