commit 2d8445c0f5b4f6d963fa87ec54d95fc8f2f7a58c
author TreeHugger Robot <treehugger-gerrit@google.com> Thu Mar 26 22:23:35 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Thu Mar 26 22:23:35 2020 +0000
tree 012fa8599b3839a4ddc1f7c05158a38b111539d7
parent 9ff3377e7222b6a2dcfbc2744ea9eafe600a85ff
parent 630da80b15f5897e4ac42eb80f207f732b483613

Merge "Prevent OOB read in rw_i93_sm_format" into qt-qpr1-dev am: 630da80b15

Change-Id: I4541cc1f7be7baaa20f4d662b633b6a9596389d1

src/nfc/tags/rw_i93.cc

diff --git a/src/nfc/tags/rw_i93.cc b/src/nfc/tags/rw_i93.cc
index 6c49db8..996ec41 100644
--- a/src/nfc/tags/rw_i93.cc
+++ b/src/nfc/tags/rw_i93.cc
@@ -2698,7 +2698,7 @@
           (p_i93->product_version == RW_I93_TAG_IT_HF_I_PRO_CHIP_INLAY) ||
           ((p_i93->uid[1] == I93_UID_IC_MFG_CODE_NXP) &&
            (p_i93->ic_reference & I93_ICODE_IC_REF_MBREAD_MASK))) {
-        if ((*p) & I93_BLOCK_LOCKED) {
+        if (length == 0 || ((*p) & I93_BLOCK_LOCKED)) {
           rw_i93_handle_error(NFC_STATUS_FAILED);
           break;
         }