From 86b3fd72660abc3c660d0033b1369e20a4c71657 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bahad=C4=B1r=20TEM=C4=B0ZER?=
 <1861672+bahadirtmzr@users.noreply.github.com>
Date: Tue, 18 Aug 2026 17:49:18 +0300
Subject: [PATCH] Reject DG2 images unless FAC header matches

The ISO 19794-5 'FAC\0' check used &&, so it only failed when every
header byte was wrong. Require all four bytes and a minimum length.
---
 Sources/NFCPassportReader/DataGroups/DataGroup2.swift    | 5 ++++-
 Tests/NFCPassportReaderTests/DataGroupParsingTests.swift | 8 ++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/Sources/NFCPassportReader/DataGroups/DataGroup2.swift b/Sources/NFCPassportReader/DataGroups/DataGroup2.swift
index 3324f538..acfd62cd 100644
--- a/Sources/NFCPassportReader/DataGroups/DataGroup2.swift
+++ b/Sources/NFCPassportReader/DataGroups/DataGroup2.swift
@@ -91,7 +91,10 @@ public class DataGroup2 : DataGroup {
     
     func parseISO19794_5( data : [UInt8] ) throws {
         // Validate header - 'F', 'A' 'C' 0x00 - 0x46414300
-        if data[0] != 0x46 && data[1] != 0x41 && data[2] != 0x43 && data[3] != 0x00 {
+        guard data.count >= 4 else {
+            throw NFCPassportReaderError.UnknownImageFormat
+        }
+        if data[0] != 0x46 || data[1] != 0x41 || data[2] != 0x43 || data[3] != 0x00 {
             throw NFCPassportReaderError.InvalidResponse(
                 dataGroupId: datagroupType,
                 expectedTag: 0x46,
diff --git a/Tests/NFCPassportReaderTests/DataGroupParsingTests.swift b/Tests/NFCPassportReaderTests/DataGroupParsingTests.swift
index 27e0b465..edd28001 100644
--- a/Tests/NFCPassportReaderTests/DataGroupParsingTests.swift
+++ b/Tests/NFCPassportReaderTests/DataGroupParsingTests.swift
@@ -42,6 +42,14 @@ final class DataGroupParsingTests: XCTestCase {
         }
         
     }
+
+    func testDatagroup2RejectsInvalidFACHeader() {
+        // Same truncated DG2 as JPEG2000, but FAC trailer 0x00 replaced with 0x01.
+        // The old `&&` header check only rejected when every byte was wrong.
+        let dg2 = hexRepToBin("75617F61570201017F6082203FA1128002010081010282010087020101880200085F2E38464143013031300000002026000100002018000000000000000000010000000000000001000000000000000000000000000C6A5020200D0A")
+        let dgp = DataGroupParser()
+        XCTAssertThrowsError(try dgp.parseDG(data: dg2))
+    }
     
     func testDatagroup2ParsingJPEG() {