Merge cherrypicks of [5317808, 5317809, 5318498, 5317873, 5318338, 5318195, 5318499, 5317874, 5317875, 5317876, 5318243, 5318244, 5318537, 5318538, 5318539, 5318540, 5318541, 5318542, 5318543, 5318544, 5318545, 5318546, 5315210, 5317756, 5318557, 5318558, 5318559, 5318560, 5318561, 5318339, 5318547, 5318548, 5318549, 5318562, 5318563, 5318564, 5318565, 5318566, 5318172, 5318173, 5318174, 5318550, 5318401, 5318196, 5317889, 5318175, 5318176, 5318577, 5318578, 5318579, 5318580, 5318581, 5318503, 5318390, 5318505, 5318341, 5318551] into pi-qpr1-release
Change-Id: Ic2a312a9d2250f7b31b56dd55d57a39a2697b6e7
diff --git a/src/nfc/llcp/llcp_link.cc b/src/nfc/llcp/llcp_link.cc
index cebabba..8a5ddf2 100644
--- a/src/nfc/llcp/llcp_link.cc
+++ b/src/nfc/llcp/llcp_link.cc
@@ -1131,7 +1131,7 @@
agf_length = p_agf->len;
p = (uint8_t*)(p_agf + 1) + p_agf->offset;
- while (agf_length > 0) {
+ while (agf_length >= LLCP_PDU_HEADER_SIZE) {
/* get length of PDU */
p_pdu_length = p;
BE_STREAM_TO_UINT16(pdu_length, p);
diff --git a/src/nfc/llcp/llcp_util.cc b/src/nfc/llcp/llcp_util.cc
index 8b582d8..7c5d851 100644
--- a/src/nfc/llcp/llcp_util.cc
+++ b/src/nfc/llcp/llcp_util.cc
@@ -26,6 +26,7 @@
#include <android-base/stringprintf.h>
#include <base/logging.h>
+#include <log/log.h>
#include "bt_types.h"
#include "gki.h"
@@ -49,20 +50,34 @@
bool llcp_util_parse_link_params(uint16_t length, uint8_t* p_bytes) {
uint8_t param_type, param_len, *p = p_bytes;
- while (length) {
+ while (length >= 2) {
BE_STREAM_TO_UINT8(param_type, p);
- length--;
+ BE_STREAM_TO_UINT8(param_len, p);
+ if (length < param_len + 2) {
+ android_errorWriteLog(0x534e4554, "114238578");
+ LOG(ERROR) << StringPrintf("Bad TLV's");
+ return false;
+ }
+ length -= param_len + 2;
switch (param_type) {
case LLCP_VERSION_TYPE:
- BE_STREAM_TO_UINT8(param_len, p);
+ if (param_len != LLCP_VERSION_LEN) {
+ android_errorWriteLog(0x534e4554, "114238578");
+ LOG(ERROR) << StringPrintf("Bad TLV's");
+ return false;
+ }
BE_STREAM_TO_UINT8(llcp_cb.lcb.peer_version, p);
DLOG_IF(INFO, nfc_debug_enabled)
<< StringPrintf("Peer Version - 0x%02X", llcp_cb.lcb.peer_version);
break;
case LLCP_MIUX_TYPE:
- BE_STREAM_TO_UINT8(param_len, p);
+ if (param_len != LLCP_MIUX_LEN) {
+ android_errorWriteLog(0x534e4554, "114238578");
+ LOG(ERROR) << StringPrintf("Bad TLV's");
+ return false;
+ }
BE_STREAM_TO_UINT16(llcp_cb.lcb.peer_miu, p);
llcp_cb.lcb.peer_miu &= LLCP_MIUX_MASK;
llcp_cb.lcb.peer_miu += LLCP_DEFAULT_MIU;
@@ -71,14 +86,22 @@
break;
case LLCP_WKS_TYPE:
- BE_STREAM_TO_UINT8(param_len, p);
+ if (param_len != LLCP_WKS_LEN) {
+ android_errorWriteLog(0x534e4554, "114238578");
+ LOG(ERROR) << StringPrintf("Bad TLV's");
+ return false;
+ }
BE_STREAM_TO_UINT16(llcp_cb.lcb.peer_wks, p);
DLOG_IF(INFO, nfc_debug_enabled)
<< StringPrintf("Peer WKS - 0x%04X", llcp_cb.lcb.peer_wks);
break;
case LLCP_LTO_TYPE:
- BE_STREAM_TO_UINT8(param_len, p);
+ if (param_len != LLCP_LTO_LEN) {
+ android_errorWriteLog(0x534e4554, "114238578");
+ LOG(ERROR) << StringPrintf("Bad TLV's");
+ return false;
+ }
BE_STREAM_TO_UINT8(llcp_cb.lcb.peer_lto, p);
llcp_cb.lcb.peer_lto *= LLCP_LTO_UNIT; /* 10ms unit */
DLOG_IF(INFO, nfc_debug_enabled)
@@ -86,7 +109,11 @@
break;
case LLCP_OPT_TYPE:
- BE_STREAM_TO_UINT8(param_len, p);
+ if (param_len != LLCP_OPT_LEN) {
+ android_errorWriteLog(0x534e4554, "114238578");
+ LOG(ERROR) << StringPrintf("Bad TLV's");
+ return false;
+ }
BE_STREAM_TO_UINT8(llcp_cb.lcb.peer_opt, p);
DLOG_IF(INFO, nfc_debug_enabled)
<< StringPrintf("Peer OPT - 0x%02X", llcp_cb.lcb.peer_opt);
@@ -94,17 +121,9 @@
default:
LOG(ERROR) << StringPrintf("Unexpected type 0x%x", param_type);
- BE_STREAM_TO_UINT8(param_len, p);
p += param_len;
break;
}
-
- if (length >= param_len + 1)
- length -= param_len + 1;
- else {
- LOG(ERROR) << StringPrintf("Bad LTV's");
- return false;
- }
}
return true;
}
@@ -474,13 +493,24 @@
p_params->sn[0] = 0;
p_params->sn[1] = 0;
- while (length) {
+ while (length >= 2) {
BE_STREAM_TO_UINT8(param_type, p);
- length--;
+ BE_STREAM_TO_UINT8(param_len, p);
+ /* check remaining lengh */
+ if (length < param_len + 2) {
+ android_errorWriteLog(0x534e4554, "111660010");
+ LOG(ERROR) << StringPrintf("Bad TLV's");
+ return LLCP_STATUS_FAIL;
+ }
+ length -= param_len + 2;
switch (param_type) {
case LLCP_MIUX_TYPE:
- BE_STREAM_TO_UINT8(param_len, p);
+ if (param_len != LLCP_MIUX_LEN) {
+ android_errorWriteLog(0x534e4554, "111660010");
+ LOG(ERROR) << StringPrintf("Bad TLV's");
+ return LLCP_STATUS_FAIL;
+ }
BE_STREAM_TO_UINT16(p_params->miu, p);
p_params->miu &= LLCP_MIUX_MASK;
p_params->miu += LLCP_DEFAULT_MIU;
@@ -490,7 +520,11 @@
break;
case LLCP_RW_TYPE:
- BE_STREAM_TO_UINT8(param_len, p);
+ if (param_len != LLCP_RW_LEN) {
+ android_errorWriteLog(0x534e4554, "111660010");
+ LOG(ERROR) << StringPrintf("Bad TLV's");
+ return LLCP_STATUS_FAIL;
+ }
BE_STREAM_TO_UINT8(p_params->rw, p);
p_params->rw &= 0x0F;
@@ -499,8 +533,6 @@
break;
case LLCP_SN_TYPE:
- BE_STREAM_TO_UINT8(param_len, p);
-
if (param_len == 0) {
/* indicate that SN type is included without SN */
p_params->sn[1] = LLCP_SN_TYPE;
@@ -519,18 +551,9 @@
default:
LOG(ERROR) << StringPrintf("Unexpected type 0x%x", param_type);
- BE_STREAM_TO_UINT8(param_len, p);
p += param_len;
break;
}
-
- /* check remaining lengh */
- if (length >= param_len + 1) {
- length -= param_len + 1;
- } else {
- LOG(ERROR) << StringPrintf("Bad LTV's");
- return LLCP_STATUS_FAIL;
- }
}
return LLCP_STATUS_SUCCESS;
}
@@ -607,13 +630,23 @@
*p_miu = LLCP_DEFAULT_MIU;
*p_rw = LLCP_DEFAULT_RW;
- while (length) {
+ while (length >= 2) {
BE_STREAM_TO_UINT8(param_type, p);
- length--;
+ BE_STREAM_TO_UINT8(param_len, p);
+ if (length < param_len + 2) {
+ android_errorWriteLog(0x534e4554, "114237888");
+ LOG(ERROR) << StringPrintf("Bad TLV's");
+ return LLCP_STATUS_FAIL;
+ }
+ length -= param_len + 2;
switch (param_type) {
case LLCP_MIUX_TYPE:
- BE_STREAM_TO_UINT8(param_len, p);
+ if (param_len != LLCP_MIUX_LEN) {
+ android_errorWriteLog(0x534e4554, "114237888");
+ LOG(ERROR) << StringPrintf("Bad TLV's");
+ return LLCP_STATUS_FAIL;
+ }
BE_STREAM_TO_UINT16((*p_miu), p);
(*p_miu) &= LLCP_MIUX_MASK;
(*p_miu) += LLCP_DEFAULT_MIU;
@@ -623,7 +656,11 @@
break;
case LLCP_RW_TYPE:
- BE_STREAM_TO_UINT8(param_len, p);
+ if (param_len != LLCP_RW_LEN) {
+ android_errorWriteLog(0x534e4554, "114237888");
+ LOG(ERROR) << StringPrintf("Bad TLV's");
+ return LLCP_STATUS_FAIL;
+ }
BE_STREAM_TO_UINT8((*p_rw), p);
(*p_rw) &= 0x0F;
@@ -633,17 +670,9 @@
default:
LOG(ERROR) << StringPrintf("Unexpected type 0x%x", param_type);
- BE_STREAM_TO_UINT8(param_len, p);
p += param_len;
break;
}
-
- if (length >= param_len + 1)
- length -= param_len + 1;
- else {
- LOG(ERROR) << StringPrintf("Bad LTV's");
- return LLCP_STATUS_FAIL;
- }
}
return LLCP_STATUS_SUCCESS;
}
diff --git a/src/nfc/tags/rw_t2t_ndef.cc b/src/nfc/tags/rw_t2t_ndef.cc
index e8902a9..03d205e 100644
--- a/src/nfc/tags/rw_t2t_ndef.cc
+++ b/src/nfc/tags/rw_t2t_ndef.cc
@@ -26,6 +26,7 @@
#include <android-base/stringprintf.h>
#include <base/logging.h>
+#include <log/log.h>
#include "nfc_target.h"
@@ -615,6 +616,10 @@
/* Extract lockbytes info addressed by this Lock TLV */
xx = 0;
+ if (count > RW_T2T_MAX_LOCK_BYTES) {
+ count = RW_T2T_MAX_LOCK_BYTES;
+ android_errorWriteLog(0x534e4554, "112161557");
+ }
while (xx < count) {
p_t2t->lockbyte[p_t2t->num_lockbytes].tlv_index =
p_t2t->num_lock_tlvs;
