OOB read in phNciNfc_RecvMfResp()
The size of RspBuff for Mifare shall be at least 2 bytes:
Mifare Req/Rsp Id + Status
Bug: 221852424
Test: build ok
Change-Id: I3a1e10997de8d2a7cb8bbb524fc8788aaf97944e
diff --git a/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp b/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
index 604f881..6eac138 100644
--- a/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
+++ b/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
@@ -1117,8 +1117,9 @@
if (NULL == RspBuffInfo) {
status = NFCSTATUS_FAILED;
} else {
- if ((0 == (RspBuffInfo->wLen)) || (PH_NCINFC_STATUS_OK != wStatus) ||
- (NULL == (RspBuffInfo->pBuff))) {
+ if (((PHNCINFC_EXTNID_SIZE + PHNCINFC_EXTNSTATUS_SIZE) >
+ RspBuffInfo->wLen) ||
+ (PH_NCINFC_STATUS_OK != wStatus) || (NULL == (RspBuffInfo->pBuff))) {
status = NFCSTATUS_FAILED;
} else {
RecvdExtnRspId = (phNciNfc_ExtnRespId_t)RspBuffInfo->pBuff[0];
@@ -1132,10 +1133,6 @@
NdefMap->State == PH_FRINFC_NDEFMAP_STATE_WRITE ||
NdefMap->State == PH_FRINFC_NDEFMAP_STATE_WR_NDEF_LEN ||
NdefMap->State == PH_FRINFC_NDEFMAP_STATE_INIT)) {
- if (2 > RspBuffInfo->wLen) {
- android_errorWriteLog(0x534e4554, "181346550");
- return NFCSTATUS_FAILED;
- }
uint8_t rspAck = RspBuffInfo->pBuff[RspBuffInfo->wLen - 2];
uint8_t rspAckMask = ((RspBuffInfo->pBuff[RspBuffInfo->wLen - 1]) &
MAX_NUM_VALID_BITS_FOR_ACK);
@@ -1149,11 +1146,6 @@
status = NFCSTATUS_SUCCESS;
uint16_t wRecvDataSz = 0;
- if ((PHNCINFC_EXTNID_SIZE + PHNCINFC_EXTNSTATUS_SIZE) >
- RspBuffInfo->wLen) {
- android_errorWriteLog(0x534e4554, "181346550");
- return NFCSTATUS_FAILED;
- }
/* DataLen = TotalRecvdLen - (sizeof(RspId) + sizeof(Status)) */
wPldDataSize = ((RspBuffInfo->wLen) -
(PHNCINFC_EXTNID_SIZE + PHNCINFC_EXTNSTATUS_SIZE));