commit e6b3a6be0dc87628e417ae018c38b7062b3b63ac
author Ruchi Kandoi <kandoiruchi@google.com> Thu Nov 15 14:35:15 2018 -0800
committer JP Sugarbroad <jpsugar@google.com> Mon Jan 14 14:54:31 2019 -0800
tree b2ae289188539d59d6f419f9876d718b010fdfc8
parent 1ba3239c63e7d180973df644b983d80a94ba2983

Fix CVE

Test: NFC enable/disable
Bug: 119223615
Bug: 111699773
Bug: 111660010
(cherry picked from commit 93233eb6f2a9e602c059edc20e26845384432db6)

src/nfc/llcp/llcp_link.c

diff --git a/src/nfc/llcp/llcp_link.c b/src/nfc/llcp/llcp_link.c
index ff81f6b..ffcdc9b 100644
--- a/src/nfc/llcp/llcp_link.c
+++ b/src/nfc/llcp/llcp_link.c
@@ -1189,7 +1189,7 @@
     agf_length = p_agf->len;
     p = (UINT8 *) (p_agf + 1) + p_agf->offset;
 
-    while (agf_length > 0)
+    while (agf_length >= LLCP_PDU_HEADER_SIZE)
     {
         /* get length of PDU */
         p_pdu_length = p;

src/nfc/llcp/llcp_util.c

diff --git a/src/nfc/llcp/llcp_util.c b/src/nfc/llcp/llcp_util.c
index 9585845..8f6a557 100644
--- a/src/nfc/llcp/llcp_util.c
+++ b/src/nfc/llcp/llcp_util.c
@@ -585,7 +585,6 @@
 
         default:
             LLCP_TRACE_ERROR1 ("llcp_util_parse_connect (): Unexpected type 0x%x", param_type);
-            BE_STREAM_TO_UINT8 (param_len, p);
             p += param_len;
             break;
         }