commit | 203fd5c775164909552d7bf870d382e55ad1d961 | [log] [tgz] |
---|---|---|
author | Alisher Alikhodjaev <alisher@google.com> | Tue May 02 14:20:57 2023 -0700 |
committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | Thu May 11 18:39:18 2023 +0000 |
tree | d934c0f066fa8aea39ec80d4b2afe8d74d52f274 | |
parent | 50e97eec14e580d08dfcc5175ad3164238a8de36 [diff] |
OOBW in rw_i93_send_to_upper() Bug: 271849189 Test: tag r/w (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:dc9d09e1698725712628d394bf9be4c9003579e8) Merged-In: I1d55954e56a3f995f8dd48bf484fe9fce02b2ed1 Change-Id: I1d55954e56a3f995f8dd48bf484fe9fce02b2ed1
diff --git a/src/nfc/tags/rw_i93.cc b/src/nfc/tags/rw_i93.cc index e06142b..5c3e8f4 100644 --- a/src/nfc/tags/rw_i93.cc +++ b/src/nfc/tags/rw_i93.cc
@@ -578,6 +578,15 @@ case I93_CMD_GET_MULTI_BLK_SEC: case I93_CMD_EXT_GET_MULTI_BLK_SEC: + if (UINT16_MAX - length < NFC_HDR_SIZE) { + rw_data.i93_cmd_cmpl.status = NFC_STATUS_FAILED; + rw_data.i93_cmd_cmpl.command = p_i93->sent_cmd; + rw_cb.tcb.i93.sent_cmd = 0; + + event = RW_I93_CMD_CMPL_EVT; + break; + } + /* forward tag data or security status */ p_buff = (NFC_HDR*)GKI_getbuf((uint16_t)(length + NFC_HDR_SIZE)); @@ -4287,4 +4296,4 @@ default: return "UNKNOWN"; } -} \ No newline at end of file +}