commit ab9a7222b404e9a2db5288134e965f726372af63
author George Chang <georgekgchang@google.com> Wed Jun 05 15:19:20 2019 +0800
committer android-build-team Robot <android-build-team-robot@google.com> Wed Jun 12 09:55:44 2019 +0000
tree e9287fd4f94f38efc8b0b57daa6c2edbb1e11bc4
parent 79f25156e03e148b1eec3031b0d8d8cdf5a9e8ab

Prevent OOB Read in Mfc_Transceive

Bug: 125900276
Test: Manual test/ Mifare Tag Read/Write
Exempt-From-Owner-Approval: Old Owners are all transferred to another BU
Change-Id: Id142d52ef682db4d4605d0e8e3d0516dacfd8d8a
(cherry picked from commit c881804750e233b4c09d702caa42af9e597448bb)

nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp

diff --git a/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp b/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
index 5ce5844..9f04c18 100644
--- a/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
+++ b/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
@@ -1005,6 +1005,10 @@
 
   EXTNS_SetCallBackFlag(true);
   if (p_data[0] == 0x60 || p_data[0] == 0x61) {
+    if (len < 12) {
+      android_errorWriteLog(0x534e4554, "125900276");
+      return status;
+    }
     NdefMap->Cmd.MfCmd = (phNfc_eMifareCmdList_t)p_data[0];
 
     NdefMap->SendRecvBuf[i++] = p_data[1];