Skip to content

Commit b134223

Browse files
author
Nick Pelly
committed
Make Mifare Classic increment/decrement operands little endian
Also make sure they are non-negative. This is not documented in Mifare Classic spec, but based on findings from NXP: - Operand should be stored in little-endian format in the transceive buffer - Tag ignores the sign bit on the operand, its effectively 31-bit unsigned - Overflow and underflow generates an error. Change-Id: Id3389b3894ded732c4b00d564ca53f5df651359e
1 parent cc019c0 commit b134223

File tree

1 file changed

+13
-2
lines changed

1 file changed

+13
-2
lines changed

core/java/android/nfc/tech/MifareClassic.java

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222

2323
import java.io.IOException;
2424
import java.nio.ByteBuffer;
25+
import java.nio.ByteOrder;
2526

2627
/**
2728
* Technology class representing MIFARE Classic tags (also known as MIFARE Standard).
@@ -328,12 +329,14 @@ public void writeBlock(int blockIndex, byte[] data) throws IOException {
328329
*/
329330
public void increment(int blockIndex, int value) throws IOException {
330331
validateBlock(blockIndex);
332+
validateValueOperand(value);
331333
checkConnected();
332334

333335
ByteBuffer cmd = ByteBuffer.allocate(6);
336+
cmd.order(ByteOrder.LITTLE_ENDIAN);
334337
cmd.put( (byte) 0xC1 );
335338
cmd.put( (byte) blockIndex );
336-
cmd.putInt(value); // ByteBuffer does the correct big endian translation
339+
cmd.putInt(value);
337340

338341
transceive(cmd.array(), false);
339342
}
@@ -345,16 +348,24 @@ public void increment(int blockIndex, int value) throws IOException {
345348
*/
346349
public void decrement(int blockIndex, int value) throws IOException {
347350
validateBlock(blockIndex);
351+
validateValueOperand(value);
348352
checkConnected();
349353

350354
ByteBuffer cmd = ByteBuffer.allocate(6);
355+
cmd.order(ByteOrder.LITTLE_ENDIAN);
351356
cmd.put( (byte) 0xC0 );
352357
cmd.put( (byte) blockIndex );
353-
cmd.putInt(value); // ByteBuffer does the correct big endian translation
358+
cmd.putInt(value);
354359

355360
transceive(cmd.array(), false);
356361
}
357362

363+
private void validateValueOperand(int value) {
364+
if (value < 0) {
365+
throw new IllegalArgumentException("value operand negative");
366+
}
367+
}
368+
358369
/**
359370
* Copy from temporary memory to value block.
360371
* @param blockIndex

0 commit comments

Comments
 (0)