commit 78da91030812ba87780c15c53380acbc66575350
author George Chang <georgekgchang@google.com> Wed Jun 05 14:17:03 2019 +0800
committer android-build-team Robot <android-build-team-robot@google.com> Tue Jun 11 21:05:09 2019 +0000
tree ac7d02d29da7f40382d11982f5fdc0984e5ce1ab
parent 4bcd27dc660f436491f532f58eb800418e212be9

Prevent OOB write in phFriNfc_ExtnsTransceive

Bug: 132083376
Test: Manual test/ Read/Write Mifare Tag
Exempt-From-Owner-Approval: Old Owners are all transferred to another BU.
Change-Id: Ic6e5053b369ead645293c94854431b1c17ed6431
(cherry picked from commit 46d00688b8673d1f8099cb2e07ef7b8cd3e1dc79)

nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp

diff --git a/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp b/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
index 1261c3f..a950eb3 100644
--- a/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
+++ b/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
@@ -16,6 +16,7 @@
 
 #include <android-base/stringprintf.h>
 #include <base/logging.h>
+#include <log/log.h>
 #include <nfc_api.h>
 #include <nfc_int.h>
 #include <phNfcCompId.h>
@@ -1857,6 +1858,11 @@
       0x00, 0x00, 0x00, 0x00,
   };
 
+  if (SendLength == 0) {
+    android_errorWriteLog(0x534e4554, "132083376");
+    return status;
+  }
+
   buff = (uint8_t*)malloc((uint32_t)MAX_BUFF_SIZE);
   if (NULL == buff) {
     return status;