commit 7cd831f7b3bd1e6e6f99edcb6481f09f93f22351
author Jack Yu <jackcwyu@google.com> Wed Mar 18 20:09:14 2020 +0800
committer Jack Yu <jackcwyu@google.com> Fri Mar 20 10:40:37 2020 +0000
tree c22124ca0cd997ceaba1fde3623eeb19aeb6ac74
parent a705221ae525ec5d1935659db2daf4ff886fb818

Prevent OOB read in rw_i93_sm_format

Bug: 146435761
Test: read i93 tag
Change-Id: I428941b86d442c9dea07a20686e06b877144ecc1
(cherry picked from commit bd0f7aae7bfee6ee3e9e6cab7aba1726bedd7eee)

src/nfc/tags/rw_i93.cc

diff --git a/src/nfc/tags/rw_i93.cc b/src/nfc/tags/rw_i93.cc
index a1b487a..33d5229 100644
--- a/src/nfc/tags/rw_i93.cc
+++ b/src/nfc/tags/rw_i93.cc
@@ -2616,7 +2616,7 @@
           (p_i93->product_version == RW_I93_TAG_IT_HF_I_PRO_CHIP_INLAY) ||
           ((p_i93->uid[1] == I93_UID_IC_MFG_CODE_NXP) &&
            (p_i93->ic_reference & I93_ICODE_IC_REF_MBREAD_MASK))) {
-        if ((*p) & I93_BLOCK_LOCKED) {
+        if (length == 0 || ((*p) & I93_BLOCK_LOCKED)) {
           rw_i93_handle_error(NFC_STATUS_FAILED);
           break;
         }