commit 43076082a26427e7b3e38a542298ab0c0e5f74ea
author George Chang <georgekgchang@google.com> Fri Jan 11 18:17:54 2019 +0800
committer JP Sugarbroad <jpsugar@google.com> Tue Feb 12 13:10:19 2019 -0800
tree 4ef18e1fe2804316e868a19d11585a18bd30111b
parent ee874a1bf554e4c7df84a24c045553d9f811de89

Prevent integer underflow in rw_t3t_act_handle_check_ndef_rsp()

Bug: 120502559
Test: NFC Enable/Disable, Read T3T Tag
Change-Id: I25389b85b14e74b0a20eb2e41373b5708ea057b1
(cherry picked from commit 88f53627149c5cebc10b64f8a0b1a9b52bf3895d)

src/nfc/tags/rw_t3t.c

diff --git a/src/nfc/tags/rw_t3t.c b/src/nfc/tags/rw_t3t.c
index 1e5da86..d0795c6 100644
--- a/src/nfc/tags/rw_t3t.c
+++ b/src/nfc/tags/rw_t3t.c
@@ -1527,10 +1527,11 @@
         nfc_status = NFC_STATUS_FAILED;
         GKI_freebuf (p_msg_rsp);
     }
-    else
+    else if (p_msg_rsp->len >= T3T_MSG_RSP_OFFSET_CHECK_DATA && p_t3t_rsp[T3T_MSG_RSP_OFFSET_NUMBLOCKS] > 0)
     {
         /* Notify app of NDEF segment received */
-        rsp_num_bytes_rx = p_t3t_rsp[T3T_MSG_RSP_OFFSET_NUMBLOCKS] * 16;    /* Number of bytes received, according to header */
+        /* Number of bytes received, according to header */
+        rsp_num_bytes_rx = p_t3t_rsp[T3T_MSG_RSP_OFFSET_NUMBLOCKS] * 16;
         p_cb->ndef_rx_offset += p_cb->ndef_rx_readlen;
         read_data.status = NFC_STATUS_OK;
         p_msg_rsp->offset += T3T_MSG_RSP_OFFSET_CHECK_DATA;     /* Skip over t3t header (point to block data) */
@@ -1566,6 +1567,13 @@
             }
         }
     }
+    else
+    {
+        android_errorWriteLog(0x534e4554, "120502559");
+        GKI_freebuf(p_msg_rsp);
+        nfc_status = NFC_STATUS_FAILED;
+        RW_TRACE_ERROR0 ("Underflow in p_msg_rsp->len!");
+    }
 
     /* Notify app of RW_T3T_CHECK_CPLT_EVT if entire NDEF has been read, or if failure */
     if (check_complete)