commit 0e108e626d7399f89a4bb0c4f1e782490dd2deb3
author Jack Yu <jackcwyu@google.com> Wed Mar 04 16:09:02 2020 +0800
committer Jack Yu <jackcwyu@google.com> Fri Mar 20 10:40:08 2020 +0000
tree 27420b6bd678d68d1a09ad8e238083732988fc3c
parent a705221ae525ec5d1935659db2daf4ff886fb818

Prevent OOB read in nfc_ncif_proc_t3t_polling_ntf

Bug: 141547128
Test: detect t3t
Change-Id: I382beb74e8cedecdc80aa53b0bd802d0e63eb34f
(cherry picked from commit a466f53939062b4cd0417c8e7c39b4c664104bd0)

src/nfc/nfc/nfc_ncif.cc

diff --git a/src/nfc/nfc/nfc_ncif.cc b/src/nfc/nfc/nfc_ncif.cc
index 0322a97..63534f5 100644
--- a/src/nfc/nfc/nfc_ncif.cc
+++ b/src/nfc/nfc/nfc_ncif.cc
@@ -1541,6 +1541,10 @@
   uint8_t status;
   uint8_t num_responses;
 
+  if (plen < NFC_TL_SIZE) {
+    return;
+  }
+
   /* Pass result to RW_T3T for processing */
   STREAM_TO_UINT8(status, p);
   STREAM_TO_UINT8(num_responses, p);