Fix out-of-bounds write in checkUiccListenConfigNeeded
The `RoutingManager::checkUiccListenConfigNeeded` function lacked validation for the `nb_config` index against the maximum supported execution environments (`NFA_EE_MAX_EE_SUPPORTED`). If the maximum number of execution environments was exceeded, this flaw allowed an out-of-bounds write, potentially corrupting adjacent synchronization primitives and causing process crashes or deadlocks within the NFC system service.
This commit resolves the issue by adding a bounds check before appending a new UICC listen configuration. If `nb_config` reaches `NFA_EE_MAX_EE_SUPPORTED`, the function now logs an error and returns false, preventing the out-of-bounds array access. A new unit test is also introduced to ensure the overflow condition is handled safely.
Test: atest RoutingManagerTest
Bug: 524820424
Flag: EXEMPT BUGFIX
This was autogenerated by MendIt (go/androidmendit)
(cherry picked from commit b19f65e0b8b024e49387a2f566deaa1cf33d6316)
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:51f9711a559d8e80aa91c4dba339ca44738e55a8
Merged-In: I7d30e4f68b62858056ae2f50cc5676886057ec54
Change-Id: I7d30e4f68b62858056ae2f50cc5676886057ec54
1 file changed