commit 421360e63c2eb37233dcd6b824da22122c79990d
author Alisher Alikhodjaev <alisher@google.com> Sun Jul 24 15:20:08 2022 -0700
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Sun Sep 25 23:52:54 2022 +0000
tree add434be60c097902c9c6b21ca2dee7cfbb25efa
parent 13145a75b9d7f5be44f2d9c88136ba7673983605

OOBW in phNxpNciHal_write_unlocked()

Bug: 230356196
Test: builds ok
Change-Id: Ief580984ad58dbc7c57c2537c511d6b81c91b581
(cherry picked from commit 9b103dd005ba3b4a33d54518e879010254d897ae)
Merged-In: Ief580984ad58dbc7c57c2537c511d6b81c91b581

pn8x/halimpl/hal/phNxpNciHal_ext.cc

diff --git a/pn8x/halimpl/hal/phNxpNciHal_ext.cc b/pn8x/halimpl/hal/phNxpNciHal_ext.cc
index 6918228..af48591 100644
--- a/pn8x/halimpl/hal/phNxpNciHal_ext.cc
+++ b/pn8x/halimpl/hal/phNxpNciHal_ext.cc
@@ -773,7 +773,8 @@
     status = NFCSTATUS_FAILED;
   }
   // 2002 0904 3000 3100 3200 5000
-  else if ((p_cmd_data[0] == 0x20 && p_cmd_data[1] == 0x02) &&
+  else if (*cmd_len <= (NCI_MAX_DATA_LEN - 1) &&
+           (p_cmd_data[0] == 0x20 && p_cmd_data[1] == 0x02) &&
            ((p_cmd_data[2] == 0x09 && p_cmd_data[3] == 0x04) /*||
             (p_cmd_data[2] == 0x0D && p_cmd_data[3] == 0x04)*/
             )) {

snxxx/halimpl/hal/phNxpNciHal_ext.cc

diff --git a/snxxx/halimpl/hal/phNxpNciHal_ext.cc b/snxxx/halimpl/hal/phNxpNciHal_ext.cc
index 6b6b6a7..61d41f1 100755
--- a/snxxx/halimpl/hal/phNxpNciHal_ext.cc
+++ b/snxxx/halimpl/hal/phNxpNciHal_ext.cc
@@ -902,7 +902,8 @@
     status = NFCSTATUS_FAILED;
   }
   // 2002 0904 3000 3100 3200 5000
-  else if ((p_cmd_data[0] == 0x20 && p_cmd_data[1] == 0x02) &&
+  else if (*cmd_len <= (NCI_MAX_DATA_LEN - 1) &&
+           (p_cmd_data[0] == 0x20 && p_cmd_data[1] == 0x02) &&
            ((p_cmd_data[2] == 0x09 && p_cmd_data[3] == 0x04) /*||
             (p_cmd_data[2] == 0x0D && p_cmd_data[3] == 0x04)*/
             )) {