commit 607eeb497f6d51b5749d38a99833d522798da22e
author Alisher Alikhodjaev <alisher@google.com> Thu Jan 16 13:45:40 2020 -0800
committer Anis Assi <anisassi@google.com> Thu Feb 06 15:17:37 2020 -0800
tree f6689471a6306b05f0ec16d77d66e5d1b96a67bd
parent a60c0462c0b8aebaf1971300e855132f62372bc8

OOB write in rw_t2t_handle_tlv_detect_rsp

Bug: 147309942
Bug: 147310271
Test: use proxmark as described in b/147309942
Merged-In: I44a3f26afb3591d1a94e2e0d7a8b1619beeaa7d6
Change-Id: I46161fc7db30c203eeed02d696da792ef15f2f61
(cherry picked from commit 975d2564e72852cfcb31e7b6f40c24b36e469bc0)

src/nfc/tags/rw_t2t_ndef.c

diff --git a/src/nfc/tags/rw_t2t_ndef.c b/src/nfc/tags/rw_t2t_ndef.c
index def45bb..4e5d855 100644
--- a/src/nfc/tags/rw_t2t_ndef.c
+++ b/src/nfc/tags/rw_t2t_ndef.c
@@ -592,6 +592,12 @@
               android_errorWriteLog(0x534e4554, "120506143");
             }
             if ((tlvtype == TAG_LOCK_CTRL_TLV) || (tlvtype == TAG_NDEF_TLV)) {
+              if (p_t2t->num_lockbytes > 0) {
+                RW_TRACE_ERROR0("Malformed tag!");
+                android_errorWriteLog(0x534e4554, "147309942");
+                failed = true;
+                break;
+              }
               /* Collect Lock TLV */
               p_t2t->tlv_value[2 - p_t2t->bytes_count] = p_data[offset];
               if (p_t2t->bytes_count == 0) {