commit 71764b791f262491e3f628c14ce3949863dd6058
author Ruchi Kandoi <kandoiruchi@google.com> Wed Oct 17 16:14:08 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Thu Nov 15 18:20:30 2018 +0000
tree 359ad6a7da6bd990dc8700e7f639a7d3da65c9d7
parent 5f0f0cc6a10f710dea7e1ddd4ba19acb877a7081

Prevent OOB error in nfc_ncif_proc_get_routing()

Test: Tag reading; Card Emulation
Bug: 117554809
Change-Id: Ib49af2eadf870f030a6cddeec390dc498bd5078c
(cherry picked from commit ded496ea745656018dda505c23726b4304180c38)

src/nfc/nfc/nfc_ncif.cc

diff --git a/src/nfc/nfc/nfc_ncif.cc b/src/nfc/nfc/nfc_ncif.cc
index 93666e0..6d6607d 100644
--- a/src/nfc/nfc/nfc_ncif.cc
+++ b/src/nfc/nfc/nfc_ncif.cc
@@ -25,6 +25,7 @@
  ******************************************************************************/
 #include <android-base/stringprintf.h>
 #include <base/logging.h>
+#include <log/log.h>
 #include <metricslogger/metrics_logger.h>
 
 #include "nfc_target.h"
@@ -1235,8 +1236,13 @@
       for (yy = 0; yy < evt_data.num_tlvs; yy++) {
         tl = *(p + 1);
         tl += NFC_TL_SIZE;
-        STREAM_TO_ARRAY(pn, p, tl);
         evt_data.tlv_size += tl;
+        if (evt_data.tlv_size > NFC_MAX_EE_TLV_SIZE) {
+          android_errorWriteLog(0x534e4554, "117554809");
+          LOG(ERROR) << __func__ << "Invalid data format";
+          return;
+        }
+        STREAM_TO_ARRAY(pn, p, tl);
         pn += tl;
       }
       tNFC_RESPONSE nfc_response;