Terminate MFC NDEF read on length inflation attempt Prevent heap out-of-bounds write by explicitly marking the operation as failed. Bug: 508389703 Test: Manual Flag: EXEMPT BUGFIX (cherry picked from commit b129d10e1242590d5d6440273f31c9dbc74cef9b) Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:82dd1ae8ef78897bdcb0d9461a49a132e37593ef Merged-In: I766483737419b9dc5bfcb0a59d302266cac5a440 Change-Id: I766483737419b9dc5bfcb0a59d302266cac5a440
diff --git a/libnfc-nci/src/nfc/tags/rw_mfc.cc b/libnfc-nci/src/nfc/tags/rw_mfc.cc index 21c904c..4fe4634 100644 --- a/libnfc-nci/src/nfc/tags/rw_mfc.cc +++ b/libnfc-nci/src/nfc/tags/rw_mfc.cc
@@ -1378,6 +1378,7 @@ } } else { android_errorWriteLog(0x534e4554, "178725766"); + failed = true; } if (p_mfc->work_offset >= p_mfc->ndef_length) {