commit 82b39ec5d6dfe805e77492c635b3e828590a540e
author Alisher Alikhodjaev <alisher@google.com> Mon Sep 13 19:08:41 2021 -0700
committer Alisher Alikhodjaev <alisher@google.com> Mon Sep 13 19:08:41 2021 -0700
tree cc16f70b04b7b1fdc189108fe9dbb87f218e74fa
parent d2da65241813e0511a8e03f69617a8cd4380fbe5

Possible OOBW in phNxpNHal_DtaUpdate

Bug: 183487770
Test: build ok
Change-Id: I90e0c9dc86d09e14599a690e4dd3970413d492ec

pn8x/halimpl/hal/phNxpNciHal_dta.cc

diff --git a/pn8x/halimpl/hal/phNxpNciHal_dta.cc b/pn8x/halimpl/hal/phNxpNciHal_dta.cc
index 956cc70..b83a683 100755
--- a/pn8x/halimpl/hal/phNxpNciHal_dta.cc
+++ b/pn8x/halimpl/hal/phNxpNciHal_dta.cc
@@ -17,6 +17,7 @@
 
 #include <phNxpConfig.h>
 #include <phNxpLog.h>
+#include <phNxpNciHal.h>
 #include <phNxpNciHal_dta.h>
 
 /****** Global Variables*********/
@@ -139,6 +140,10 @@
       status = NFCSTATUS_FAILED;
       phNxpNciHal_print_packet("DTARECV", p_rsp_data, 5);
     } else if (p_cmd_data[0] == 0x21 && p_cmd_data[1] == 0x03) {
+      if (*cmd_len > (NCI_MAX_DATA_LEN - 6)) {
+        android_errorWriteLog(0x534e4554, "183487770");
+        return NFCSTATUS_FAILED;
+      }
       NXPLOG_NCIHAL_D(">>>>DTA Add NFC-F listen tech params");
       p_cmd_data[2] += 6;
       p_cmd_data[3] += 3;