Fix integer underflow and OOB access in libnfc-nci
A compromised NFC controller sending repeated unsolicited NFCEE_DISCOVER_NTF messages can trigger an integer underflow in the `nfa_ee_cb.cur_ee` counter. This underflowed value is subsequently used as a loop bound without proper checks, leading to out-of-bounds reads and writes in the ECB array.
This commit resolves the vulnerability by:
1. Introducing an `incremented` boolean flag in `nfa_ee_nci_disc_ntf` to track whether `cur_ee` was advanced. The decrement operation at the end of the function is now gated by this flag, preventing the integer underflow.
2. Adding explicit bounds checking (`xx < NFA_EE_NUM_ECBS`) to multiple loops iterating over `cur_ee` in `nfa_ee_act.cc` and `nfa_ee_main.cc` to strictly safeguard against out-of-bounds pointer traversal.
Test: m libnfc-nci && atest libnfc-nci-tests
Bug: 522366268
Flag: EXEMPT BUGFIX
This was autogenerated by MendIt (go/androidmendit)
(cherry picked from commit 07372b9c58ab44edc700f5f39627e888f4acac91)
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:e00c7568557136188a6c3c4c0e3c45b1600b02b7
Merged-In: I0763511f1d9bf0f0c4ee3704f15a7b3c98f4b145
Change-Id: I0763511f1d9bf0f0c4ee3704f15a7b3c98f4b145
2 files changed