Fix out-of-bounds write in NFC activation handling
When an NFCC sends a short RF_INTF_ACTIVATED_NTF packet, a parsing failure can bypass the initialization of a tech parameter union on the stack. This uninitialized stack data is later used as a length parameter for a memcpy, leading to an out-of-bounds write in the NFC process that can corrupt function pointers.
This commit resolves the issue by fully zero-initializing the `evt_data.activate` structure in `nfc_ncif_proc_activate()`, preventing uninitialized stack memory from being passed to the callback path. Furthermore, it adds a bounds check in `nfa_dm_notify_activation_status()` to clamp `nfcid_len` to `NCI_NFCID1_MAX_LEN` when decoding the `NFC_DISCOVERY_TYPE_POLL_A` parameter block, mitigating unbounded writes.
Test: Built libnfc-nci module and ran alint.
Bug: 522373576
Flag: EXEMPT BUGFIX
This was autogenerated by MendIt (go/androidmendit)
(cherry picked from commit f974b0fee85ff9910610f913e64df59c827cdaf7)
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:69e0da3fdbebcac18f6865136f1d76e71e579c80
Merged-In: Iedd07da2dd238a27550c8d8bdfa9ab8d4cd1050f
Change-Id: Iedd07da2dd238a27550c8d8bdfa9ab8d4cd1050f
2 files changed