From 0beee0c6a7e7014101f9061d1eb518d5a55abd1c Mon Sep 17 00:00:00 2001
From: Willy-JL <49810075+Willy-JL@users.noreply.github.com>
Date: Thu, 6 Mar 2025 02:52:02 +0000
Subject: [PATCH] Fix reading NLEN header in NDEF message

---
 lib/nfc/protocols/type_4_tag/type_4_tag_poller_i.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/nfc/protocols/type_4_tag/type_4_tag_poller_i.c b/lib/nfc/protocols/type_4_tag/type_4_tag_poller_i.c
index 496277bc9..1edc793f7 100644
--- a/lib/nfc/protocols/type_4_tag/type_4_tag_poller_i.c
+++ b/lib/nfc/protocols/type_4_tag/type_4_tag_poller_i.c
@@ -213,10 +213,10 @@ Type4TagError type_4_tag_poller_read_ndef(Type4TagPoller* instance) {
             FURI_LOG_D(TAG, "NDEF file is empty");
             break;
         }
-        if(ndef_len > 510) {
+        if(ndef_len > 510 - sizeof(ndef_len)) {
             // Both size and offset for READ BINARY are 1 byte uint
             // So the furthest we can read is 255 bytes at offset 255
-            // AKA 2 * 255 byte chunks = 510 bytes
+            // AKA 2 * 255 byte chunks = 510 bytes -2 byte NDEF len header
             // TODO: Surely there has to be another way?
             FURI_LOG_E(TAG, "NDEF file too long: %zu bytes", ndef_len);
             error = Type4TagErrorProtocol;
@@ -240,7 +240,7 @@ Type4TagError type_4_tag_poller_read_ndef(Type4TagPoller* instance) {
                 instance->tx_buffer,
                 type_4_tag_read_ndef_apdu_1,
                 sizeof(type_4_tag_read_ndef_apdu_1));
-            bit_buffer_append_byte(instance->tx_buffer, (uint8_t)ndef_pos);
+            bit_buffer_append_byte(instance->tx_buffer, (uint8_t)(sizeof(ndef_len) + ndef_pos));
             bit_buffer_append_byte(instance->tx_buffer, chunk_len);
 
             error = type_4_tag_apdu_trx(instance, instance->tx_buffer, instance->rx_buffer);