Vendor NFC read permits out-of-bounds EEPROM access

[Arslan8]

The VENDOR_NFC_GET command in Src/admin_vendor.c validates only the starting EEPROM address:

addr = (DATA[0] << 8) | DATA[1];
if (addr > 0x03CF)
    EXCEPT(SW_WRONG_DATA);

fm_read_eeprom(addr, RDATA, LE);

The APDU-controlled read length LE is not included in the bounds check. As a result, an authenticated client can request a valid starting address while causing the actual read to extend beyond the permitted EEPROM range.

A minimal trigger is:

addr = 0x03CF
LE   = 2

The request passes validation but accesses:

0x03CF  // last permitted address
0x03D0  // outside the validated region

This allows the vendor APDU interface to access data outside the intended NFC EEPROM/configuration region. Depending on the FM11NC08 behavior for out-of-range sequential reads, this may expose unintended EEPROM contents, access reserved regions, or cause abnormal NFC-controller behavior.

Because both the starting address and requested length are supplied through the vendor APDU interface, the affected range is externally controllable once the Admin interface is authenticated.

Suggested fix

Validate the complete requested range before issuing the EEPROM read:

if (addr > 0x03CF ||
    LE == 0 ||
    (uint32_t)addr + LE - 1 > 0x03CF) {
    EXCEPT(SW_WRONG_DATA);
}