commit 5830caa72e1103db24cd5353ef958c8f6228482c
author George Chang <georgekgchang@google.com> Tue Jan 08 15:40:12 2019 +0800
committer JP Sugarbroad <jpsugar@google.com> Mon Jan 14 16:23:29 2019 -0800
tree 57a9f9dae05e12c8c3c18c41915baae4090b3304
parent 145eb54985df51c272ceaa52d80f2ba1ef7ebb81

Prevent Out of bounds write in rw_t3t_handle_get_sc_poll_rsp()

Test: Read T3T Tag
Bug: 120499324
Merged-In: I5f76f207d16ee744ec9be06e94034adf01727ac8
Change-Id: I5f76f207d16ee744ec9be06e94034adf01727ac8
(cherry picked from commit 1072729ca2d0fc5344774e0a6145e197788d6634)

src/nfc/tags/rw_t3t.c

diff --git a/src/nfc/tags/rw_t3t.c b/src/nfc/tags/rw_t3t.c
index b269beb..06fb714 100644
--- a/src/nfc/tags/rw_t3t.c
+++ b/src/nfc/tags/rw_t3t.c
@@ -1653,7 +1653,12 @@
     BE_STREAM_TO_UINT16(sc, p);
 
     RW_TRACE_DEBUG1("FeliCa detected (RD, system code %04X)", sc);
-    p_cb->system_codes[p_cb->num_system_codes++] = sc;
+    if (p_cb->num_system_codes < T3T_MAX_SYSTEM_CODES) {
+      p_cb->system_codes[p_cb->num_system_codes++] = sc;
+    } else {
+      RW_TRACE_ERROR0("Exceed T3T_MAX_SYSTEM_CODES!");
+      android_errorWriteLog(0x534e4554, "120499324");
+    }
   }
 
   rw_t3t_handle_get_system_codes_cplt();