commit 9f6dcf8ab3d7b808d3ef46cfe8a84444d581697c
author Alisher Alikhodjaev <alisher@google.com> Thu Jun 18 10:21:08 2020 -0700
committer Alisher Alikhodjaev <alisher@google.com> Mon Jun 22 13:10:48 2020 -0700
tree 36d6874253cd9b4dbafaaa7a38aade53de73617e
parent f8b13742710857e3b18f8e75850b9e1894ab7a52

Potential OOB write in CE_SendRawFrame

Bug: 157649398
Test: build ok
Change-Id: I70bd34dd1b5ded4314950ace52d497d1ea1e7452

src/nfc/tags/ce_main.cc

diff --git a/src/nfc/tags/ce_main.cc b/src/nfc/tags/ce_main.cc
index 27c218c..1afc848 100644
--- a/src/nfc/tags/ce_main.cc
+++ b/src/nfc/tags/ce_main.cc
@@ -27,6 +27,7 @@
 
 #include <android-base/stringprintf.h>
 #include <base/logging.h>
+#include <log/log.h>
 
 #include "nfc_target.h"
 
@@ -64,6 +65,12 @@
   uint8_t* p;
 
   if (ce_cb.p_cback) {
+    if (data_len > GKI_get_pool_bufsize(NFC_RW_POOL_ID) - NCI_MSG_OFFSET_SIZE -
+                       NCI_DATA_HDR_SIZE - 1) {
+      android_errorWriteLog(0x534e4554, "157649398");
+      return NFC_STATUS_FAILED;
+    }
+
     /* a valid opcode for RW */
     p_data = (NFC_HDR*)GKI_getpoolbuf(NFC_RW_POOL_ID);
     if (p_data) {