commit c955b35d7c14128df87e53ac440ae45b5d6464c0
author Jack Yu <jackcwyu@google.com> Tue Jan 08 21:20:15 2019 +0800
committer android-build-team Robot <android-build-team-robot@google.com> Fri Mar 15 23:11:05 2019 +0000
tree d3fb07068de3b3a75a6495799db020678c59faed
parent b2687f9105113bbae0a221508c44300d92af0ba9

Prevent OOB read in rw_t3t_act_handle_ndef_detect_rsp()

Test: NFC enable/disable
Bug: 120428041
Change-Id: Iecabf9c9b2115371f02eefe3bb1fd1c8875fed45
(cherry picked from commit 352f23a26c162d5482a11660ea38571b858e0fd4)

src/nfc/tags/rw_t3t.c

diff --git a/src/nfc/tags/rw_t3t.c b/src/nfc/tags/rw_t3t.c
index b42bb22..429cc68 100644
--- a/src/nfc/tags/rw_t3t.c
+++ b/src/nfc/tags/rw_t3t.c
@@ -1288,6 +1288,10 @@
     {
         evt_data.status = NFC_STATUS_FAILED;
     }
+    else if (p_msg_rsp->len < (T3T_MSG_RSP_OFFSET_CHECK_DATA + T3T_MSG_BLOCKSIZE)) {
+        evt_data.status = NFC_STATUS_FAILED;
+        android_errorWriteLog(0x534e4554, "120428041");
+    }
     else
     {
         /* Get checksum from received ndef attribute msg */