Merge "Extend the NFC product range compatibility"
diff --git a/src/adaptation/libmain.cc b/src/adaptation/libmain.cc
index 8ceb5ff..6e26347 100644
--- a/src/adaptation/libmain.cc
+++ b/src/adaptation/libmain.cc
@@ -89,7 +89,11 @@
   int fileStream = open(filename.c_str(), O_RDONLY);
   if (fileStream >= 0) {
     uint16_t checksum = 0;
-    read(fileStream, &checksum, sizeof(checksum));
+    size_t checkSumRdData = read(fileStream, &checksum, sizeof(checksum));
+    if (checkSumRdData <= 0) {
+      LOG(ERROR) << StringPrintf("%s: failed to read checksum, errno = 0x%02x",
+                                 __func__, errno);
+    }
     size_t actualReadData = read(fileStream, pBuffer, nbytes);
     close(fileStream);
     if (actualReadData > 0) {
@@ -174,11 +178,30 @@
 
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("%s", __func__);
 
-  remove(getFilenameForBlock(DH_NV_BLOCK).c_str());
-  remove(getFilenameForBlock(HC_F2_NV_BLOCK).c_str());
-  remove(getFilenameForBlock(HC_F3_NV_BLOCK).c_str());
-  remove(getFilenameForBlock(HC_F4_NV_BLOCK).c_str());
-  remove(getFilenameForBlock(HC_F5_NV_BLOCK).c_str());
+  if (remove(getFilenameForBlock(DH_NV_BLOCK).c_str())) {
+    LOG(ERROR) << StringPrintf(
+        "%s: fail to delete DH_NV_BLOCK file, errno = 0x%02X", __func__, errno);
+  }
+  if (remove(getFilenameForBlock(HC_F2_NV_BLOCK).c_str())) {
+    LOG(ERROR) << StringPrintf(
+        "%s: fail to delete HC_F2_NV_BLOCK file, errno = 0x%02X", __func__,
+        errno);
+  }
+  if (remove(getFilenameForBlock(HC_F3_NV_BLOCK).c_str())) {
+    LOG(ERROR) << StringPrintf(
+        "%s: fail to delete HC_F3_NV_BLOCK file, errno = 0x%02X", __func__,
+        errno);
+  }
+  if (remove(getFilenameForBlock(HC_F4_NV_BLOCK).c_str())) {
+    LOG(ERROR) << StringPrintf(
+        "%s: fail to delete HC_F4_NV_BLOCK file, errno = 0x%02X", __func__,
+        errno);
+  }
+  if (remove(getFilenameForBlock(HC_F5_NV_BLOCK).c_str())) {
+    LOG(ERROR) << StringPrintf(
+        "%s: fail to delete HC_F5_NV_BLOCK file, errno = 0x%02X", __func__,
+        errno);
+  }
 }
 
 /*******************************************************************************
diff --git a/src/adaptation/nfc_config.cc b/src/adaptation/nfc_config.cc
index 5891cc4..f406847 100644
--- a/src/adaptation/nfc_config.cc
+++ b/src/adaptation/nfc_config.cc
@@ -19,6 +19,7 @@
 #include <android-base/file.h>
 #include <android-base/logging.h>
 #include <android-base/parseint.h>
+#include <android-base/properties.h>
 #include <android-base/strings.h>
 
 #include <config.h>
@@ -27,12 +28,9 @@
 using namespace ::android::base;
 
 namespace {
-
-std::string findConfigPath() {
+std::string searchConfigPath(std::string file_name) {
   const vector<string> search_path = {"/odm/etc/", "/vendor/etc/",
                                       "/product/etc/", "/etc/"};
-  const string file_name = "libnfc-nci.conf";
-
   for (string path : search_path) {
     path.append(file_name);
     struct stat file_stat;
@@ -41,6 +39,28 @@
   }
   return "";
 }
+// Configuration File Search sequence
+// 1. If prop_config_file_name is defined.(where prop_config_file_name is the
+//   value of the property persist.nfc_cfg.config_file_name)
+//   Search a file matches prop_config_file_name.
+// 2. If SKU is defined (where SKU is the value of the property
+//   ro.boot.product.hardware.sku)
+//   Search a file matches libnfc-nci-SKU.conf
+// 3. If none of 1,2 is defined, search a default file name "libnfc-nci.conf".
+std::string findConfigPath() {
+  string f_path = searchConfigPath(
+      android::base::GetProperty("persist.nfc_cfg.config_file_name", ""));
+  if (!f_path.empty()) return f_path;
+
+  // Search for libnfc-nci-SKU.conf
+  f_path = searchConfigPath(
+      "libnfc-nci-" +
+      android::base::GetProperty("ro.boot.product.hardware.sku", "") + ".conf");
+  if (!f_path.empty()) return f_path;
+
+  // load default file if the desired file not found.
+  return searchConfigPath("libnfc-nci.conf");
+}
 
 }  // namespace
 
diff --git a/src/gki/ulinux/gki_ulinux.cc b/src/gki/ulinux/gki_ulinux.cc
index fc3b5c6..093b58d 100644
--- a/src/gki/ulinux/gki_ulinux.cc
+++ b/src/gki/ulinux/gki_ulinux.cc
@@ -118,8 +118,6 @@
   pthread_mutexattr_t attr;
   tGKI_OS* p_os;
 
-  memset(&gki_cb, 0, sizeof(gki_cb));
-
   gki_buffer_init();
   gki_timers_init();
   gki_cb.com.OSTicks = (uint32_t)times(nullptr);
@@ -315,7 +313,7 @@
       }
 #endif
       DLOG_IF(INFO, nfc_debug_enabled)
-          << StringPrintf("task %s dead", gki_cb.com.OSTName[task_id]);
+          << StringPrintf("task %s dead", gki_cb.com.OSTName[task_id - 1]);
       GKI_exit_task(task_id - 1);
     }
   }
diff --git a/src/include/buildcfg.h b/src/include/buildcfg.h
index 86e7aec..b66695b 100644
--- a/src/include/buildcfg.h
+++ b/src/include/buildcfg.h
@@ -17,6 +17,7 @@
  ******************************************************************************/
 #ifndef __BUILDCFG_H
 #define __BUILDCFG_H
+#include <cutils/memory.h>
 #include <memory.h>
 #include <stdio.h>
 #include <string.h>
diff --git a/src/include/nci_defs.h b/src/include/nci_defs.h
index 6745673..b43cb1c 100644
--- a/src/include/nci_defs.h
+++ b/src/include/nci_defs.h
@@ -616,7 +616,7 @@
 } tNCI_RF_LF_PARAMS;
 
 #ifndef NCI_MAX_ATS_LEN
-#define NCI_MAX_ATS_LEN 60
+#define NCI_MAX_ATS_LEN 64
 #endif
 #ifndef NCI_MAX_HIS_BYTES_LEN
 #define NCI_MAX_HIS_BYTES_LEN 50
diff --git a/src/nfa/dm/nfa_dm_act.cc b/src/nfa/dm/nfa_dm_act.cc
index 5476749..aa494fb 100644
--- a/src/nfa/dm/nfa_dm_act.cc
+++ b/src/nfa/dm/nfa_dm_act.cc
@@ -153,7 +153,8 @@
 
     /* LF_T3T_PMM value is added to LF_T3T_IDENTIFIERS_X in NCI2.0. */
     for (xx = 0; xx < NFA_CE_LISTEN_INFO_MAX; xx++) {
-      for (uint8_t yy = 10; yy < NCI_PARAM_LEN_LF_T3T_ID(NCI_VERSION_2_0); yy++)
+      for (uint8_t yy = 10; yy < NCI_PARAM_LEN_LF_T3T_ID(NFC_GetNCIVersion());
+           yy++)
         nfa_dm_cb.params.lf_t3t_id[xx][yy] = 0xFF;
     }
   } else {
diff --git a/src/nfa/dm/nfa_dm_api.cc b/src/nfa/dm/nfa_dm_api.cc
index e8334dc..20b1730 100644
--- a/src/nfa/dm/nfa_dm_api.cc
+++ b/src/nfa/dm/nfa_dm_api.cc
@@ -1278,14 +1278,9 @@
   if (p_msg != nullptr) {
     p_msg->hdr.event = NFA_DM_API_SEND_RAW_VS_EVT;
     p_msg->p_cback = p_cback;
-    if (cmd_params_len && p_cmd_params) {
-      p_msg->cmd_params_len = cmd_params_len;
-      p_msg->p_cmd_params = (uint8_t*)(p_msg + 1);
-      memcpy(p_msg->p_cmd_params, p_cmd_params, cmd_params_len);
-    } else {
-      p_msg->cmd_params_len = 0;
-      p_msg->p_cmd_params = nullptr;
-    }
+    p_msg->cmd_params_len = cmd_params_len;
+    p_msg->p_cmd_params = (uint8_t*)(p_msg + 1);
+    memcpy(p_msg->p_cmd_params, p_cmd_params, cmd_params_len);
 
     nfa_sys_sendmsg(p_msg);
 
diff --git a/src/nfa/dm/nfa_dm_discover.cc b/src/nfa/dm/nfa_dm_discover.cc
index 8e5cd5c..0925434 100644
--- a/src/nfa/dm/nfa_dm_discover.cc
+++ b/src/nfa/dm/nfa_dm_discover.cc
@@ -1573,6 +1573,7 @@
     deact.status = NFC_STATUS_OK;
     deact.type = NFC_DEACTIVATE_TYPE_DISCOVERY;
     deact.is_ntf = true;
+    deact.reason = NFC_DEACTIVATE_REASON_DH_REQ;
     tNFC_DISCOVER nfc_discover;
     nfc_discover.deactivate = deact;
     nfa_dm_disc_notify_deactivation(NFA_DM_RF_DEACTIVATE_NTF, &nfc_discover);
@@ -2164,7 +2165,7 @@
       if (!(nfa_dm_cb.disc_cb.disc_flags & NFA_DM_DISC_FLAGS_W4_NTF)) {
         /* it's race condition. received deactivate NTF before receiving RSP */
 
-        tNFC_DEACTIVATE_DEVT deact;
+        tNFC_DEACTIVATE_DEVT deact = tNFC_DEACTIVATE_DEVT();
         deact.status = NFC_STATUS_OK;
         deact.type = NFC_DEACTIVATE_TYPE_IDLE;
         deact.is_ntf = true;
@@ -2251,23 +2252,17 @@
       } else if (p_data->nfc_discover.deactivate.type ==
                  NFC_DEACTIVATE_TYPE_DISCOVERY) {
         nfa_dm_disc_new_state(NFA_DM_RFST_DISCOVERY);
-        /* if deactivation type is discovery and comes after 3 tentatives of
-         * unsuccessful deactivation to sleep then reset the counter and  notify
+        /* If deactivation type is discovery, reset the counter and notify
          * upper layer.
-         *
          */
-        if (nfa_dm_cb.deactivate_cmd_retry_count == 3) {
-          nfa_dm_cb.deactivate_cmd_retry_count = 0;
-          DLOG_IF(INFO, nfc_debug_enabled)
-              << __func__
-              << StringPrintf(
-                     " NFA_DM_RF_DEACTIVATE_NTF to discovery after 3 attempt "
-                     "of deactivate (sleep)");
-          if (p_data->nfc_discover.deactivate.reason ==
-              NFC_DEACTIVATE_REASON_DH_REQ_FAILED) {
-            nfa_dm_disc_notify_deactivation(NFA_DM_RF_DEACTIVATE_NTF,
-                                            &(p_data->nfc_discover));
-          }
+        nfa_dm_cb.deactivate_cmd_retry_count = 0;
+        DLOG_IF(INFO, nfc_debug_enabled)
+            << __func__
+            << StringPrintf("NFA_DM_RF_DEACTIVATE_NTF to discovery");
+        if (p_data->nfc_discover.deactivate.reason ==
+            NFC_DEACTIVATE_REASON_DH_REQ_FAILED) {
+          nfa_dm_disc_notify_deactivation(NFA_DM_RF_DEACTIVATE_NTF,
+                                          &(p_data->nfc_discover));
         }
         if (nfa_dm_cb.disc_cb.disc_flags & NFA_DM_DISC_FLAGS_STOPPING) {
           /* stop discovery */
@@ -2308,7 +2303,7 @@
 *******************************************************************************/
 static void nfa_dm_disc_sm_listen_active(tNFA_DM_RF_DISC_SM_EVENT event,
                                          tNFA_DM_RF_DISC_DATA* p_data) {
-  tNFC_DEACTIVATE_DEVT deact;
+  tNFC_DEACTIVATE_DEVT deact = tNFC_DEACTIVATE_DEVT();
 
   switch (event) {
     case NFA_DM_RF_DEACTIVATE_CMD:
@@ -2467,7 +2462,6 @@
   switch (event) {
     case NFA_DM_RF_INTF_ACTIVATED_NTF:
       nfa_dm_disc_new_state(NFA_DM_RFST_LP_ACTIVE);
-      nfa_dm_disc_notify_activation(&(p_data->nfc_discover));
       if (nfa_dm_disc_notify_activation(&(p_data->nfc_discover)) ==
           NFA_STATUS_FAILED) {
         DLOG_IF(INFO, nfc_debug_enabled)
diff --git a/src/nfa/ee/nfa_ee_act.cc b/src/nfa/ee/nfa_ee_act.cc
index 02548de..ccc1e50 100644
--- a/src/nfa/ee/nfa_ee_act.cc
+++ b/src/nfa/ee/nfa_ee_act.cc
@@ -122,7 +122,8 @@
                              uint8_t* p) {
   int len = aid_len;
   int xx, yy = 0;
-  char buff[100];
+  const uint8_t MAX_BUFF_SIZE = 100;
+  char buff[MAX_BUFF_SIZE];
 
   buff[0] = 0;
   if (aid_len > NFA_MAX_AID_LEN) {
@@ -131,7 +132,7 @@
     len = NFA_MAX_AID_LEN;
   }
   for (xx = 0; xx < len; xx++) {
-    yy += sprintf(&buff[yy], "%02x ", *p);
+    yy += snprintf(&buff[yy], MAX_BUFF_SIZE - yy, "%02x ", *p);
     p++;
   }
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
@@ -1487,7 +1488,11 @@
     evt_data.status = NFA_STATUS_INVALID_PARAM;
   }
   /* report the status of this operation */
-  nfa_ee_report_event(p_cb->p_ee_cback, NFA_EE_REMOVE_SYSCODE_EVT, &evt_data);
+  if (p_cb) {
+    nfa_ee_report_event(p_cb->p_ee_cback, NFA_EE_REMOVE_SYSCODE_EVT, &evt_data);
+  } else {
+    nfa_ee_report_event(NULL, NFA_EE_REMOVE_SYSCODE_EVT, &evt_data);
+  }
 }
 
 /*******************************************************************************
@@ -2072,8 +2077,7 @@
 
   for (xx = 0; xx < nfa_ee_cb.cur_ee; xx++, p_cb++) {
     if ((p_cb->ee_status & NFA_EE_STATUS_INT_MASK) ||
-        (p_cb->ee_status != NFA_EE_STATUS_ACTIVE) ||
-        ((p_cb->ecb_flags & NFA_EE_ECB_FLAGS_DISC_REQ) == 0)) {
+        (p_cb->ee_status != NFA_EE_STATUS_ACTIVE) ) {
       continue;
     }
     p_info->ee_handle = (tNFA_HANDLE)p_cb->nfcee_id | NFA_HANDLE_GROUP_EE;
diff --git a/src/nfa/ee/nfa_ee_main.cc b/src/nfa/ee/nfa_ee_main.cc
index 30a44a7..69a70d0 100644
--- a/src/nfa/ee/nfa_ee_main.cc
+++ b/src/nfa/ee/nfa_ee_main.cc
@@ -323,7 +323,7 @@
 *******************************************************************************/
 void nfa_ee_proc_evt(tNFC_RESPONSE_EVT event, void* p_data) {
   tNFA_EE_INT_EVT int_event = 0;
-  tNFA_EE_NCI_WAIT_RSP cbk;
+  tNFA_EE_NCI_WAIT_RSP cbk = tNFA_EE_NCI_WAIT_RSP();
 
   switch (event) {
     case NFC_NFCEE_DISCOVER_REVT: /* 4  NFCEE Discover response */
diff --git a/src/nfa/hci/nfa_hci_act.cc b/src/nfa/hci/nfa_hci_act.cc
index fbc4fbf..70c519c 100644
--- a/src/nfa/hci/nfa_hci_act.cc
+++ b/src/nfa/hci/nfa_hci_act.cc
@@ -262,7 +262,7 @@
       if (nfa_hci_cb.cfg.reg_app_names[xx][0] == 0) {
         memset(&nfa_hci_cb.cfg.reg_app_names[xx][0], 0,
                sizeof(nfa_hci_cb.cfg.reg_app_names[xx]));
-        strncpy(&nfa_hci_cb.cfg.reg_app_names[xx][0], p_app_name,
+        strlcpy(&nfa_hci_cb.cfg.reg_app_names[xx][0], p_app_name,
                 NFA_MAX_HCI_APP_NAME_LEN);
         nfa_hci_cb.nv_write_needed = true;
         DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
diff --git a/src/nfa/hci/nfa_hci_api.cc b/src/nfa/hci/nfa_hci_api.cc
index 03c2bb2..252cae2 100644
--- a/src/nfa/hci/nfa_hci_api.cc
+++ b/src/nfa/hci/nfa_hci_api.cc
@@ -81,7 +81,7 @@
 
     /* Save application name and callback */
     memset(p_msg->app_name, 0, sizeof(p_msg->app_name));
-    strncpy(p_msg->app_name, p_app_name, NFA_MAX_HCI_APP_NAME_LEN);
+    strlcpy(p_msg->app_name, p_app_name, NFA_MAX_HCI_APP_NAME_LEN);
     p_msg->p_cback = p_cback;
     p_msg->b_send_conn_evts = b_send_conn_evts;
 
@@ -186,7 +186,7 @@
     p_msg->hdr.event = NFA_HCI_API_DEREGISTER_APP_EVT;
 
     memset(p_msg->app_name, 0, sizeof(p_msg->app_name));
-    strncpy(p_msg->app_name, p_app_name, NFA_MAX_HCI_APP_NAME_LEN);
+    strlcpy(p_msg->app_name, p_app_name, NFA_MAX_HCI_APP_NAME_LEN);
 
     nfa_sys_sendmsg(p_msg);
     return (NFA_STATUS_OK);
diff --git a/src/nfa/hci/nfa_hci_main.cc b/src/nfa/hci/nfa_hci_main.cc
index d6667e1..c8025a6 100644
--- a/src/nfa/hci/nfa_hci_main.cc
+++ b/src/nfa/hci/nfa_hci_main.cc
@@ -699,7 +699,8 @@
   uint8_t chaining_bit;
   uint8_t pipe;
   uint16_t pkt_len;
-  char buff[100];
+  const uint8_t MAX_BUFF_SIZE = 100;
+  char buff[MAX_BUFF_SIZE];
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
       "%s State: %u  Cmd: %u", __func__, nfa_hci_cb.hci_state, event);
   if (event == NFC_CONN_CREATE_CEVT) {
@@ -789,8 +790,8 @@
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
       "nfa_hci_conn_cback Recvd data pipe:%d  %s  chain:%d  assmbl:%d  len:%d",
       (uint8_t)pipe,
-      nfa_hciu_get_type_inst_names(pipe, nfa_hci_cb.type, nfa_hci_cb.inst,
-                                   buff),
+      nfa_hciu_get_type_inst_names(pipe, nfa_hci_cb.type, nfa_hci_cb.inst, buff,
+                                   MAX_BUFF_SIZE),
       (uint8_t)chaining_bit, (uint8_t)nfa_hci_cb.assembling, p_pkt->len);
 
   /* If still reassembling fragments, just return */
diff --git a/src/nfa/hci/nfa_hci_utils.cc b/src/nfa/hci/nfa_hci_utils.cc
index d64fe6c..6a8db5d 100644
--- a/src/nfa/hci/nfa_hci_utils.cc
+++ b/src/nfa/hci/nfa_hci_utils.cc
@@ -25,6 +25,7 @@
 
 #include <android-base/stringprintf.h>
 #include <base/logging.h>
+#include <log/log.h>
 
 #include "nfa_dm_int.h"
 #include "nfa_hci_api.h"
@@ -305,13 +306,21 @@
   bool first_pkt = true;
   uint16_t data_len;
   tNFA_STATUS status = NFA_STATUS_OK;
-  uint16_t max_seg_hcp_pkt_size = nfa_hci_cb.buff_size - NCI_DATA_HDR_SIZE;
+  uint16_t max_seg_hcp_pkt_size;
+  if (nfa_hci_cb.buff_size > (NCI_DATA_HDR_SIZE + 2)) {
+    max_seg_hcp_pkt_size = nfa_hci_cb.buff_size - NCI_DATA_HDR_SIZE;
+  } else {
+    android_errorWriteLog(0x534e4554, "124521372");
+    return NFA_STATUS_NO_BUFFERS;
+  }
+  const uint8_t MAX_BUFF_SIZE = 100;
+  char buff[MAX_BUFF_SIZE];
 
-  char buff[100];
-
-  DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf(
-      "nfa_hciu_send_msg pipe_id:%d   %s  len:%d", pipe_id,
-      nfa_hciu_get_type_inst_names(pipe_id, type, instruction, buff), msg_len);
+  DLOG_IF(INFO, nfc_debug_enabled)
+      << StringPrintf("nfa_hciu_send_msg pipe_id:%d   %s  len:%d", pipe_id,
+                      nfa_hciu_get_type_inst_names(pipe_id, type, instruction,
+                                                   buff, MAX_BUFF_SIZE),
+                      msg_len);
 
   if (instruction == NFA_HCI_ANY_GET_PARAMETER)
     nfa_hci_cb.param_in_use = *p_msg;
@@ -349,8 +358,12 @@
         memcpy(p_data, p_msg, data_len);
 
         p_buf->len += data_len;
-        msg_len -= data_len;
-        if (msg_len > 0) p_msg += data_len;
+        if (msg_len >= data_len) {
+          msg_len -= data_len;
+          p_msg += data_len;
+        } else {
+          msg_len = 0;
+        }
       }
 
       if (HCI_LOOPBACK_DEBUG == NFA_HCI_DEBUG_ON)
@@ -1311,27 +1324,30 @@
 **
 *******************************************************************************/
 char* nfa_hciu_get_type_inst_names(uint8_t pipe, uint8_t type, uint8_t inst,
-                                   char* p_buff) {
+                                   char* p_buff, const uint8_t max_buff_size) {
   int xx;
 
-  xx = sprintf(p_buff, "Type: %s [0x%02x] ", nfa_hciu_type_2_str(type).c_str(),
-               type);
+  xx = snprintf(p_buff, max_buff_size, "Type: %s [0x%02x] ",
+                nfa_hciu_type_2_str(type).c_str(), type);
 
   switch (type) {
     case NFA_HCI_COMMAND_TYPE:
-      sprintf(&p_buff[xx], "Inst: %s [0x%02x] ",
-              nfa_hciu_instr_2_str(inst).c_str(), inst);
+      snprintf(&p_buff[xx], max_buff_size - xx, "Inst: %s [0x%02x] ",
+               nfa_hciu_instr_2_str(inst).c_str(), inst);
+
       break;
     case NFA_HCI_EVENT_TYPE:
-      sprintf(&p_buff[xx], "Evt: %s [0x%02x] ",
-              nfa_hciu_evt_2_str(pipe, inst).c_str(), inst);
+      snprintf(&p_buff[xx], max_buff_size - xx, "Evt: %s [0x%02x] ",
+               nfa_hciu_evt_2_str(pipe, inst).c_str(), inst);
+
       break;
     case NFA_HCI_RESPONSE_TYPE:
-      sprintf(&p_buff[xx], "Resp: %s [0x%02x] ",
-              nfa_hciu_get_response_name(inst).c_str(), inst);
+      snprintf(&p_buff[xx], max_buff_size - xx, "Resp: %s [0x%02x] ",
+               nfa_hciu_get_response_name(inst).c_str(), inst);
+
       break;
     default:
-      sprintf(&p_buff[xx], "Inst: %u ", inst);
+      snprintf(&p_buff[xx], max_buff_size - xx, "Inst: %u ", inst);
       break;
   }
   return p_buff;
diff --git a/src/nfa/include/nfa_hci_int.h b/src/nfa/include/nfa_hci_int.h
index 456c279..c9c9550 100644
--- a/src/nfa/include/nfa_hci_int.h
+++ b/src/nfa/include/nfa_hci_int.h
@@ -523,7 +523,8 @@
 extern std::string nfa_hciu_get_event_name(uint16_t event);
 extern std::string nfa_hciu_get_state_name(uint8_t state);
 extern char* nfa_hciu_get_type_inst_names(uint8_t pipe, uint8_t type,
-                                          uint8_t inst, char* p_buff);
+                                          uint8_t inst, char* p_buff,
+                                          const uint8_t max_buff_size);
 extern std::string nfa_hciu_evt_2_str(uint8_t pipe_id, uint8_t evt);
 
 #endif /* NFA_HCI_INT_H */
diff --git a/src/nfa/p2p/nfa_p2p_act.cc b/src/nfa/p2p/nfa_p2p_act.cc
index 36726e7..3fca288 100644
--- a/src/nfa/p2p/nfa_p2p_act.cc
+++ b/src/nfa/p2p/nfa_p2p_act.cc
@@ -623,7 +623,7 @@
   if (server_sap == LLCP_INVALID_SAP) {
     evt_data.reg_server.server_handle = NFA_HANDLE_INVALID;
     evt_data.reg_server.server_sap = NFA_P2P_INVALID_SAP;
-    strncpy(evt_data.reg_server.service_name,
+    strlcpy(evt_data.reg_server.service_name,
             p_msg->api_reg_server.service_name, LLCP_MAX_SN_LEN);
     evt_data.reg_server.service_name[LLCP_MAX_SN_LEN] = 0;
 
@@ -644,7 +644,7 @@
 
   evt_data.reg_server.server_handle = (NFA_HANDLE_GROUP_P2P | server_sap);
   evt_data.reg_server.server_sap = server_sap;
-  strncpy(evt_data.reg_server.service_name, p_msg->api_reg_server.service_name,
+  strlcpy(evt_data.reg_server.service_name, p_msg->api_reg_server.service_name,
           LLCP_MAX_SN_LEN);
   evt_data.reg_server.service_name[LLCP_MAX_SN_LEN] = 0;
 
@@ -903,7 +903,7 @@
   }
   /* NFA_P2pConnectByName () */
   else {
-    strncpy(conn_params.sn, p_msg->api_connect.service_name, LLCP_MAX_SN_LEN);
+    strlcpy(conn_params.sn, p_msg->api_connect.service_name, LLCP_MAX_SN_LEN);
     conn_params.sn[LLCP_MAX_SN_LEN] = 0;
 
     status = LLCP_ConnectReq(local_sap, LLCP_SAP_SDP, &conn_params);
diff --git a/src/nfa/p2p/nfa_p2p_api.cc b/src/nfa/p2p/nfa_p2p_api.cc
index 2e13dce..d27396c 100644
--- a/src/nfa/p2p/nfa_p2p_api.cc
+++ b/src/nfa/p2p/nfa_p2p_api.cc
@@ -89,7 +89,7 @@
     p_msg->server_sap = server_sap;
     p_msg->link_type = link_type;
 
-    strncpy(p_msg->service_name, p_service_name, LLCP_MAX_SN_LEN);
+    strlcpy(p_msg->service_name, p_service_name, LLCP_MAX_SN_LEN);
     p_msg->service_name[LLCP_MAX_SN_LEN] = 0;
 
     p_msg->p_cback = p_cback;
@@ -385,7 +385,7 @@
                   sizeof(tNFA_P2P_API_CONNECT))) != nullptr) {
     p_msg->hdr.event = NFA_P2P_API_CONNECT_EVT;
 
-    strncpy(p_msg->service_name, p_service_name, LLCP_MAX_SN_LEN);
+    strlcpy(p_msg->service_name, p_service_name, LLCP_MAX_SN_LEN);
     p_msg->service_name[LLCP_MAX_SN_LEN] = 0;
 
     p_msg->dsap = LLCP_INVALID_SAP;
@@ -924,7 +924,7 @@
 
     p_msg->handle = handle;
 
-    strncpy(p_msg->service_name, p_service_name, LLCP_MAX_SN_LEN);
+    strlcpy(p_msg->service_name, p_service_name, LLCP_MAX_SN_LEN);
     p_msg->service_name[LLCP_MAX_SN_LEN] = 0;
 
     nfa_sys_sendmsg(p_msg);
diff --git a/src/nfc/include/nfc_api.h b/src/nfc/include/nfc_api.h
index 3a0b673..84a1426 100644
--- a/src/nfc/include/nfc_api.h
+++ b/src/nfc/include/nfc_api.h
@@ -435,6 +435,7 @@
  *  Deactivation Reasons
  **********************************************/
 #define NFC_DEACTIVATE_REASON_DH_REQ_FAILED NCI_DEACTIVATE_REASON_DH_REQ_FAILED
+#define NFC_DEACTIVATE_REASON_DH_REQ NCI_DEACTIVATE_REASON_DH_REQ
 typedef uint8_t tNFC_DEACT_REASON;
 
 /* the data type associated with NFC_RF_FIELD_REVT */
diff --git a/src/nfc/llcp/llcp_api.cc b/src/nfc/llcp/llcp_api.cc
index 93dbc6a..0ea8c8c 100644
--- a/src/nfc/llcp/llcp_api.cc
+++ b/src/nfc/llcp/llcp_api.cc
@@ -438,7 +438,7 @@
       return LLCP_INVALID_SAP;
     }
 
-    strncpy(p_app_cb->p_service_name, p_service_name.c_str(), length + 1);
+    strlcpy(p_app_cb->p_service_name, p_service_name.c_str(), length + 1);
     p_app_cb->p_service_name[length] = 0;
   } else
     p_app_cb->p_service_name = nullptr;
diff --git a/src/nfc/nfc/nfc_ncif.cc b/src/nfc/nfc/nfc_ncif.cc
index dfb9931..462ddfe 100644
--- a/src/nfc/nfc/nfc_ncif.cc
+++ b/src/nfc/nfc/nfc_ncif.cc
@@ -180,7 +180,7 @@
   p_data = (NFC_HDR*)GKI_getfirst(&p_cb->tx_q);
 
   /* post data fragment to NCIT task as credits are available */
-  while (p_data && (p_data->len >= 0) && (p_cb->num_buff > 0)) {
+  while (p_data && (p_cb->num_buff > 0)) {
     if (p_data->len <= buffer_size) {
       pbf = 0; /* last fragment */
       ulen = (uint8_t)(p_data->len);
diff --git a/src/nfc/nfc/nfc_utils.cc b/src/nfc/nfc/nfc_utils.cc
index 7c2103a..855908b 100644
--- a/src/nfc/nfc/nfc_utils.cc
+++ b/src/nfc/nfc/nfc_utils.cc
@@ -177,7 +177,7 @@
 extern void nfc_reset_all_conn_cbs(void) {
   int xx;
   tNFC_CONN_CB* p_conn_cb = &nfc_cb.conn_cb[0];
-  tNFC_DEACTIVATE_DEVT deact;
+  tNFC_DEACTIVATE_DEVT deact = tNFC_DEACTIVATE_DEVT();
 
   deact.status = NFC_STATUS_NOT_INITIALIZED;
   deact.type = NFC_DEACTIVATE_TYPE_IDLE;
diff --git a/src/nfc/tags/ce_t4t.cc b/src/nfc/tags/ce_t4t.cc
index c8a6251..ba646e4 100644
--- a/src/nfc/tags/ce_t4t.cc
+++ b/src/nfc/tags/ce_t4t.cc
@@ -562,6 +562,10 @@
   }
 
   p_c_apdu = (NFC_HDR*)p_data->data.p_data;
+  if (!p_c_apdu) {
+    LOG(ERROR) << StringPrintf("Invalid p_c_apdu");
+    return;
+  }
 
   DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("conn_id = 0x%02X", conn_id);
 
@@ -571,7 +575,7 @@
     LOG(ERROR) << StringPrintf("Wrong length in ce_t4t_data_cback");
     android_errorWriteLog(0x534e4554, "115635871");
     ce_t4t_send_status(T4T_RSP_WRONG_LENGTH);
-    if (p_c_apdu) GKI_freebuf(p_c_apdu);
+    GKI_freebuf(p_c_apdu);
     return;
   }
 
@@ -605,7 +609,7 @@
           LOG(ERROR) << StringPrintf("Wrong length in select app cmd");
           android_errorWriteLog(0x534e4554, "115635871");
           ce_t4t_send_status(T4T_RSP_NOT_FOUND);
-          if (p_c_apdu) GKI_freebuf(p_c_apdu);
+          GKI_freebuf(p_c_apdu);
           return;
         }
       }
diff --git a/src/nfc/tags/rw_i93.cc b/src/nfc/tags/rw_i93.cc
index 4254fb3..6c49db8 100644
--- a/src/nfc/tags/rw_i93.cc
+++ b/src/nfc/tags/rw_i93.cc
@@ -1015,7 +1015,7 @@
   ARRAY8_TO_STREAM(p, rw_cb.tcb.i93.uid); /* UID */
 
   if (rw_cb.tcb.i93.intl_flags & RW_I93_FLAG_EXT_COMMANDS) {
-    UINT16_TO_STREAM(p, block_number); /* Block number */
+    UINT8_TO_STREAM(p, block_number); /* Block number */
     p_cmd->len++;
   } else {
     UINT8_TO_STREAM(p, block_number); /* Block number */
@@ -2314,8 +2314,11 @@
 
       block_number = (p_i93->ndef_tlv_start_offset + 1) / p_i93->block_size;
 
-      if (rw_i93_send_cmd_write_single_block(block_number, p) ==
-          NFC_STATUS_OK) {
+      if (length < p_i93->block_size) {
+        android_errorWriteLog(0x534e4554, "143109193");
+        rw_i93_handle_error(NFC_STATUS_FAILED);
+      } else if (rw_i93_send_cmd_write_single_block(block_number, p) ==
+                 NFC_STATUS_OK) {
         /* update next writing offset */
         p_i93->rw_offset = (block_number + 1) * p_i93->block_size;
         p_i93->sub_state = RW_I93_SUBSTATE_WRITE_NDEF;
@@ -2469,8 +2472,11 @@
 
           block_number = (p_i93->rw_offset / p_i93->block_size);
 
-          if (rw_i93_send_cmd_write_single_block(block_number, p) ==
-              NFC_STATUS_OK) {
+          if (length < p_i93->block_size) {
+            android_errorWriteLog(0x534e4554, "143155861");
+            rw_i93_handle_error(NFC_STATUS_FAILED);
+          } else if (rw_i93_send_cmd_write_single_block(block_number, p) ==
+                     NFC_STATUS_OK) {
             /* set offset to the beginning of next block */
             p_i93->rw_offset +=
                 p_i93->block_size - (p_i93->rw_offset % p_i93->block_size);
@@ -2905,7 +2911,10 @@
       /* mark CC as read-only */
       *(p + 1) |= I93_ICODE_CC_READ_ONLY;
 
-      if (rw_i93_send_cmd_write_single_block(0, p) == NFC_STATUS_OK) {
+      if (length < p_i93->block_size) {
+        android_errorWriteLog(0x534e4554, "143106535");
+        rw_i93_handle_error(NFC_STATUS_FAILED);
+      } else if (rw_i93_send_cmd_write_single_block(0, p) == NFC_STATUS_OK) {
         p_i93->sub_state = RW_I93_SUBSTATE_WAIT_UPDATE_CC;
       } else {
         rw_i93_handle_error(NFC_STATUS_FAILED);
diff --git a/src/nfc/tags/rw_mfc.cc b/src/nfc/tags/rw_mfc.cc
index 22cfc35..9427729 100644
--- a/src/nfc/tags/rw_mfc.cc
+++ b/src/nfc/tags/rw_mfc.cc
@@ -1335,7 +1335,7 @@
  **
  *******************************************************************************/
 static void rw_mfc_process_error() {
-  tRW_READ_DATA evt_data;
+  tRW_READ_DATA evt_data = tRW_READ_DATA();
   tRW_EVENT rw_event = RW_MFC_NDEF_DETECT_EVT;
   NFC_HDR* p_cmd_buf;
   tRW_MFC_CB* p_mfc = &rw_cb.tcb.mfc;
diff --git a/src/nfc/tags/rw_t3t.cc b/src/nfc/tags/rw_t3t.cc
index 6613dfc..9066471 100644
--- a/src/nfc/tags/rw_t3t.cc
+++ b/src/nfc/tags/rw_t3t.cc
@@ -1227,7 +1227,7 @@
   uint32_t temp;
   uint8_t i;
   uint16_t checksum_calc, checksum_rx;
-  tRW_DETECT_NDEF_DATA evt_data;
+  tRW_DETECT_NDEF_DATA evt_data = tRW_DETECT_NDEF_DATA();
   uint8_t* p_t3t_rsp = (uint8_t*)(p_msg_rsp + 1) + p_msg_rsp->offset;
 
   evt_data.status = NFC_STATUS_FAILED;
@@ -1423,7 +1423,7 @@
 *****************************************************************************/
 void rw_t3t_act_handle_update_rsp(tRW_T3T_CB* p_cb, NFC_HDR* p_msg_rsp) {
   uint8_t* p_t3t_rsp = (uint8_t*)(p_msg_rsp + 1) + p_msg_rsp->offset;
-  tRW_READ_DATA evt_data;
+  tRW_READ_DATA evt_data = tRW_READ_DATA();
 
   /* Validate response from tag */
   if ((p_t3t_rsp[T3T_MSG_RSP_OFFSET_STATUS1] !=
diff --git a/utils/config.cc b/utils/config.cc
index 48bee61..6354a2e 100644
--- a/utils/config.cc
+++ b/utils/config.cc
@@ -41,13 +41,17 @@
 
 }  // namespace
 
-ConfigValue::ConfigValue() {}
+ConfigValue::ConfigValue() {
+  type_ = UNSIGNED;
+  value_unsigned_ = 0;
+}
 
 ConfigValue::ConfigValue(std::string value) {
   // Don't allow empty strings
   CHECK(!(value.empty()));
   type_ = STRING;
   value_string_ = value;
+  value_unsigned_ = 0;
 }
 
 ConfigValue::ConfigValue(unsigned value) {
@@ -59,6 +63,7 @@
   CHECK(!(value.empty()));
   type_ = BYTES;
   value_bytes_ = value;
+  value_unsigned_ = 0;
 }
 
 ConfigValue::Type ConfigValue::getType() const { return type_; }