commit b264b71773f2df64b294d50c3f56bdf9a56417ee
author Ruchi Kandoi <kandoiruchi@google.com> Thu Jan 24 13:39:18 2019 -0800
committer JP Sugarbroad <jpsugar@google.com> Tue Feb 12 13:10:19 2019 -0800
tree ffcf98c00c955a95af9f0c230896b3599b54ba83
parent 43076082a26427e7b3e38a542298ab0c0e5f74ea

Prevent OOB error in rw_i93_sm_detect_ndef()

Bug: 121260197
Test: NFC tag reading
Change-Id: I9168e338a802c43122b252e895fa4dffcd7080f4
(cherry picked from commit ac469453d0789ca4d173d50662818f12447e767b)

src/nfc/tags/rw_i93.c

diff --git a/src/nfc/tags/rw_i93.c b/src/nfc/tags/rw_i93.c
index cec6af9..e4a2aed 100644
--- a/src/nfc/tags/rw_i93.c
+++ b/src/nfc/tags/rw_i93.c
@@ -23,6 +23,7 @@
  *  mode.
  *
  ******************************************************************************/
+#include <log/log.h>
 #include <string.h>
 #include "nfc_target.h"
 #include "bt_types.h"
@@ -1506,6 +1507,11 @@
     RW_TRACE_DEBUG1 ("rw_i93_sm_detect_ndef () sub_state:0x%x", p_i93->sub_state);
 #endif
 
+    if (length == 0) {
+        android_errorWriteLog(0x534e4554, "121260197");
+        rw_i93_handle_error(NFC_STATUS_FAILED);
+        return;
+    }
     STREAM_TO_UINT8 (flags, p);
     length--;
 
@@ -1528,7 +1534,11 @@
     switch (p_i93->sub_state)
     {
     case RW_I93_SUBSTATE_WAIT_UID:
-
+        if (length < (I93_UID_BYTE_LEN + 1)) {
+            android_errorWriteLog(0x534e4554, "121260197");
+            rw_i93_handle_error(NFC_STATUS_FAILED);
+            return;
+        }
         STREAM_TO_UINT8 (u8, p); /* DSFID */
         p_uid = p_i93->uid;
         STREAM_TO_ARRAY8 (p_uid, p);