commit afd41fb6681d0d7550f8fea91e4104db05248aea
author Jack Yu <jackcwyu@google.com> Wed Mar 18 20:14:05 2020 +0800
committer Jack Yu <jackcwyu@google.com> Fri Mar 20 10:40:23 2020 +0000
tree bf2c73e87c2cf30bd48cc68bf8bff6ed82bb2836
parent a705221ae525ec5d1935659db2daf4ff886fb818

Prevent OOB read in i93 tag detection

Bug: 146053215
Test: read i93 tag
Change-Id: Iea00b3fcb33c3e21059619bf9f20a92583a9f5d7
(cherry picked from commit d9f2637ec5b68ce1d62bdf2cc08050167ff6135c)

src/nfc/tags/rw_i93.cc

diff --git a/src/nfc/tags/rw_i93.cc b/src/nfc/tags/rw_i93.cc
index a1b487a..5936b88 100644
--- a/src/nfc/tags/rw_i93.cc
+++ b/src/nfc/tags/rw_i93.cc
@@ -1942,6 +1942,9 @@
         block = (p_i93->rw_offset / p_i93->block_size);
         last_block = (p_i93->ndef_tlv_last_offset / p_i93->block_size);
 
+        if (length == 0) {
+          rw_i93_handle_error(NFC_STATUS_FAILED);
+        }
         if ((*p) & I93_BLOCK_LOCKED) {
           if (block <= last_block) {
             p_i93->intl_flags |= RW_I93_FLAG_READ_ONLY;