| commit | b549d1c83278bac51391fd16dae9121228dffb3b | [log] [tgz] |
|---|---|---|
| author | George Chang <georgekgchang@google.com> | Wed Jun 05 15:32:46 2019 +0800 |
| committer | Nikoli Cartagena <dargeren@google.com> | Mon Jun 10 14:53:09 2019 -0700 |
| tree | f0a2f94e7fbdeddd911ed4466e34129ce250876c | |
| parent | 8682b1bdcf1c280621392b78fab0d638fe3d7426 [diff] |
[DO NOT MERGE]Prevent OOB Read in Mfc_Transceive Bug: 125900276 Test: Manual test/ Mifare Tag Read/Write Change-Id: Id142d52ef682db4d4605d0e8e3d0516dacfd8d8a (cherry picked from commit 73089af204949053513d849ad3717fd4e5851055)
diff --git a/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.c b/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.c index 411ec3a..a9576c2 100755 --- a/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.c +++ b/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.c
@@ -1083,6 +1083,11 @@ EXTNS_SetCallBackFlag(true); if( p_data[0] == 0x60 || p_data[0] == 0x61 ) { + if ( len < 12 ) + { + android_errorWriteLog(0x534e4554, "125900276"); + return status; + } NdefMap->Cmd.MfCmd = p_data[0];