jerpelea opened a new pull request, #19615: URL: https://github.com/apache/nuttx/pull/19615
## Summary Fix security issue where uninitialized kernel stack contents could be leaked to userspace when mfrc522_picc_select() fails. In mfrc522_read(), the local variable 'uid' was not initialized before being passed to mfrc522_picc_select(). If the function fails (e.g., due to bad data on the SPI bus), the uninitialized uid.sak value could pass the PICC_TYPE_NOT_COMPLETE check, causing snprintf() to copy uninitialized kernel stack data to the userspace buffer. Fixes #19417 ## Impact RELEASE ## Testing CI -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
