From fc24f84a63706feb2453baa6f790b82f8595ad61 Mon Sep 17 00:00:00 2001
From: Federico Cerutti <federico@ceres-c.it>
Date: Mon, 4 Mar 2019 11:58:51 +0100
Subject: [PATCH] Fixed a couple of validity checks and updated
 Titagitstandard.c to new PrepareFrame

---
 Firmware/Chameleon-Mini/Application/EM4233.c          | 5 ++---
 Firmware/Chameleon-Mini/Application/EM4233.h          | 2 ++
 Firmware/Chameleon-Mini/Application/TITagitstandard.c | 4 ++++
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/Firmware/Chameleon-Mini/Application/EM4233.c b/Firmware/Chameleon-Mini/Application/EM4233.c
index a7b2154..f3cd7a7 100644
--- a/Firmware/Chameleon-Mini/Application/EM4233.c
+++ b/Firmware/Chameleon-Mini/Application/EM4233.c
@@ -507,7 +507,7 @@ uint16_t EM4233_Login(uint8_t* FrameBuf, uint16_t FrameBytes)
     uint16_t ResponseByteCount = ISO15693_APP_NO_RESPONSE;
     uint8_t Password[4] = { 0 };
 
-    if (FrameInfo.ParamLen != 4 || !FrameInfo.Addressed)
+    if (FrameInfo.ParamLen != 4 || !FrameInfo.Addressed || !(FrameInfo.Selected && State == STATE_SELECTED))
         /* Malformed: not enough or too much data. Also this command only works in addressed mode */
         return ISO15693_APP_NO_RESPONSE;
 
@@ -544,8 +544,7 @@ uint16_t EM4233_Auth1(uint8_t* FrameBuf, uint16_t FrameBytes)
     uint16_t ResponseByteCount = ISO15693_APP_NO_RESPONSE;
     // uint8_t KeyNo = *FrameInfo.Parameters; /* Right now this parameter is unused, but it will be useful */
 
-    if (FrameInfo.ParamLen != 1 || !FrameInfo.Addressed)
-        /* Malformed: not enough or too much data. Also this command only works in addressed mode */
+    if (FrameInfo.ParamLen != 1) /* Malformed: not enough or too much data */
         return ISO15693_APP_NO_RESPONSE;
 
     FrameBuf[ISO15693_ADDR_FLAGS] = ISO15693_RES_FLAG_NO_ERROR;
diff --git a/Firmware/Chameleon-Mini/Application/EM4233.h b/Firmware/Chameleon-Mini/Application/EM4233.h
index 3cb3743..e291b6d 100644
--- a/Firmware/Chameleon-Mini/Application/EM4233.h
+++ b/Firmware/Chameleon-Mini/Application/EM4233.h
@@ -55,6 +55,8 @@
 /* Proprietary command code */
 #define EM4233_CMD_AUTH1                0xE0
 #define EM4233_CMD_AUTH2                0xE1
+#define EM4233_CMD_GEN_READ             0xE2    // Implies some sort of singed CRC. Unknown at the moment
+#define EM4233_CMD_GEN_WRITE            0xE3    // Same
 #define EM4233_CMD_LOGIN                0xE4
 
 /* Compile time switch */
diff --git a/Firmware/Chameleon-Mini/Application/TITagitstandard.c b/Firmware/Chameleon-Mini/Application/TITagitstandard.c
index 3a34177..465d426 100644
--- a/Firmware/Chameleon-Mini/Application/TITagitstandard.c
+++ b/Firmware/Chameleon-Mini/Application/TITagitstandard.c
@@ -67,6 +67,10 @@ uint16_t TITagitstandardAppProcess(uint8_t* FrameBuf, uint16_t FrameBytes)
     uint8_t Uid[ActiveConfiguration.UidSize];
     TITagitstandardGetUid(Uid);
 
+    if ((FrameBytes < ISO15693_MIN_FRAME_SIZE) || !ISO15693CheckCRC(FrameBuf, FrameBytes - ISO15693_CRC16_SIZE))
+        /* malformed frame */
+        return ResponseByteCount;
+
     if (!ISO15693PrepareFrame(FrameBuf, FrameBytes, &FrameInfo, State == STATE_SELECTED, Uid, MyAFI))
         return ISO15693_APP_NO_RESPONSE;