commit 5e470e4e3ba7058710f1a583043651d9bfb3ae94
author Jack Yu <jackcwyu@google.com> Tue Jan 08 21:20:15 2019 +0800
committer Jack Yu <jackcwyu@google.com> Tue Jan 08 21:21:18 2019 +0800
tree 637c49272e9cc84acd2afb7890426f1088b839fa
parent 3652c138153fe5ceba3520495b384c6ae14a9286

Prevent OOB read in rw_t3t_act_handle_ndef_detect_rsp()

Test: NFC enable/disable
Bug: 120428041
Change-Id: Iecabf9c9b2115371f02eefe3bb1fd1c8875fed45

src/nfc/tags/rw_t3t.cc

diff --git a/src/nfc/tags/rw_t3t.cc b/src/nfc/tags/rw_t3t.cc
index 45321e5..8130730 100644
--- a/src/nfc/tags/rw_t3t.cc
+++ b/src/nfc/tags/rw_t3t.cc
@@ -1248,6 +1248,10 @@
                       NCI_NFCID2_LEN) != 0)) /* verify response IDm */
   {
     evt_data.status = NFC_STATUS_FAILED;
+  } else if (p_msg_rsp->len <
+             (T3T_MSG_RSP_OFFSET_CHECK_DATA + T3T_MSG_BLOCKSIZE)) {
+    evt_data.status = NFC_STATUS_FAILED;
+    android_errorWriteLog(0x534e4554, "120428041");
   } else {
     /* Get checksum from received ndef attribute msg */
     p = &p_t3t_rsp[T3T_MSG_RSP_OFFSET_CHECK_DATA + T3T_MSG_NDEF_ATTR_INFO_SIZE];