commit 8d9317b401103b77237b8c72e291c24cec9472fd
author Alisher Alikhodjaev <alisher@google.com> Thu Jun 18 10:34:25 2020 -0700
committer Alisher Alikhodjaev <alisher@google.com> Mon Jun 22 12:52:12 2020 -0700
tree 07192e0c938103c2e5ec21559ee3d237c1b9f8c8
parent f8b13742710857e3b18f8e75850b9e1894ab7a52

Potential OOB write in RW_SendRawFrame

Bug: 157650117
Test: build ok
Change-Id: Ie1f4b8bdb2c5072ad8ee9dbfcd85344f69604bf3

src/nfc/tags/rw_main.cc

diff --git a/src/nfc/tags/rw_main.cc b/src/nfc/tags/rw_main.cc
index 24fe949..6ebf353 100644
--- a/src/nfc/tags/rw_main.cc
+++ b/src/nfc/tags/rw_main.cc
@@ -27,6 +27,7 @@
 
 #include <android-base/stringprintf.h>
 #include <base/logging.h>
+#include <log/log.h>
 
 #include "nfc_target.h"
 
@@ -173,6 +174,11 @@
   uint8_t* p;
 
   if (rw_cb.p_cback) {
+    if (data_len > GKI_get_pool_bufsize(NFC_RW_POOL_ID) - NCI_MSG_OFFSET_SIZE -
+                       NCI_DATA_HDR_SIZE - 1) {
+      android_errorWriteLog(0x534e4554, "157650117");
+      return NFC_STATUS_FAILED;
+    }
     /* a valid opcode for RW - remove */
     p_data = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
     if (p_data) {