commit 0fa50697bd0d12c309ce45067b2ac54002f558f2
author George Chang <georgekgchang@google.com> Tue Jan 08 15:20:51 2019 +0800
committer android-build-team Robot <android-build-team-robot@google.com> Wed Jan 16 18:57:14 2019 +0000
tree a606755db13d41d3edfa458a106cdf09437fb9ff
parent 23137c5e05cf6d87355af024e6494cf97a610beb

Prevent Out of bounds write in rw_t3t_handle_get_sc_poll_rsp()

Test: Read T3T Tag
Bug: 120499324
Change-Id: I5f76f207d16ee744ec9be06e94034adf01727ac8
(cherry picked from commit a9bf25ee60d821f301b91e21d7257315df554211)

src/nfc/tags/rw_t3t.cc

diff --git a/src/nfc/tags/rw_t3t.cc b/src/nfc/tags/rw_t3t.cc
index b911f3b..67526db 100644
--- a/src/nfc/tags/rw_t3t.cc
+++ b/src/nfc/tags/rw_t3t.cc
@@ -1650,7 +1650,12 @@
 
     DLOG_IF(INFO, nfc_debug_enabled)
         << StringPrintf("FeliCa detected (RD, system code %04X)", sc);
-    p_cb->system_codes[p_cb->num_system_codes++] = sc;
+    if (p_cb->num_system_codes < T3T_MAX_SYSTEM_CODES) {
+      p_cb->system_codes[p_cb->num_system_codes++] = sc;
+    } else {
+      LOG(ERROR) << StringPrintf("Exceed T3T_MAX_SYSTEM_CODES!");
+      android_errorWriteLog(0x534e4554, "120499324");
+    }
   }
 
   rw_t3t_handle_get_system_codes_cplt();