commit 914f67b39b6eed2515da93410df88f1162aaf831
author Alisher Alikhodjaev <alisher@google.com> Thu Jul 23 14:38:34 2020 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Wed Sep 16 23:29:41 2020 +0000
tree bc20996e10a2939b445f26f15e4f22a407960a45
parent 5f5b8b6582803e1867d8a433646de367ae144eeb

NFC - Memory disclosure in rw_i93_sm_format

Bug: 157650336
Test: build and run (no tag testing)
Exempt-From-Owner-Approval: new owner approved
Change-Id: If6cd929624f8ae8c2c70295924bea206d82d48f4
(cherry picked from commit 046b6676ad19472e2c87aa6cb35f6d42e5dcfcc6)

src/nfc/tags/rw_i93.cc

diff --git a/src/nfc/tags/rw_i93.cc b/src/nfc/tags/rw_i93.cc
index 11953d6..e06142b 100644
--- a/src/nfc/tags/rw_i93.cc
+++ b/src/nfc/tags/rw_i93.cc
@@ -2759,12 +2759,21 @@
         LOG(ERROR) << StringPrintf("Cannot allocate buffer");
         rw_i93_handle_error(NFC_STATUS_FAILED);
         break;
-      } else if (p_i93->block_size > RW_I93_FORMAT_DATA_LEN) {
-        /* Possible leaking information from previous NFC transactions */
-        /* Clear previous values */
-        memset(p_i93->p_update_data, I93_ICODE_TLV_TYPE_NULL,
-               I93_MAX_BLOCK_LENGH);
-        android_errorWriteLog(0x534e4554, "139738828");
+      } else {
+        switch (p_i93->block_size) {
+          case 4:
+          case 8:
+            break;
+          case 16:
+          case 32: /* initialize unpopulated buffer b/139738828 */
+            memset(p_i93->p_update_data, I93_ICODE_TLV_TYPE_NULL,
+                   I93_MAX_BLOCK_LENGH);
+            break;
+          default:
+            android_errorWriteLog(0x534e4554, "157650336");
+            rw_i93_handle_error(NFC_STATUS_FAILED);
+            return;
+        }
       }
 
       p = p_i93->p_update_data;