Prevent OOB error in nfc_ncif_proc_get_routing()

Test: Tag reading; Card Emulation
Bug: 117554809
Merged-In: Ib49af2eadf870f030a6cddeec390dc498bd5078c
Change-Id: Ib49af2eadf870f030a6cddeec390dc498bd5078c
(cherry picked from commit 746a1206ae2a2dac156393dc63a13853ac006fa1)
(cherry picked from commit 8cff9edcfb2ee0d889cd9ae6157d9f4c6d992e80)
diff --git a/src/nfc/nfc/nfc_ncif.cc b/src/nfc/nfc/nfc_ncif.cc
index 9c4cef8..8e0048a 100644
--- a/src/nfc/nfc/nfc_ncif.cc
+++ b/src/nfc/nfc/nfc_ncif.cc
@@ -27,6 +27,7 @@
 #include <metricslogger/metrics_logger.h>
 #include <stdlib.h>
 #include <string.h>
+
 #include "nfc_target.h"
 
 #include "include/debug_nfcsnoop.h"
@@ -1217,8 +1218,13 @@
       for (yy = 0; yy < evt_data.num_tlvs; yy++) {
         tl = *(p + 1);
         tl += NFC_TL_SIZE;
-        STREAM_TO_ARRAY(pn, p, tl);
         evt_data.tlv_size += tl;
+        if (evt_data.tlv_size > NFC_MAX_EE_TLV_SIZE) {
+          android_errorWriteLog(0x534e4554, "117554809");
+          NFC_TRACE_ERROR1("%s Invalid data format", __func__);
+          return;
+        }
+        STREAM_TO_ARRAY(pn, p, tl);
         pn += tl;
       }
       (*nfc_cb.p_resp_cback)(NFC_GET_ROUTING_REVT, (tNFC_RESPONSE*)&evt_data);