diff --git a/src/nfa/dm/nfa_dm_api.cc b/src/nfa/dm/nfa_dm_api.cc
index 888d2ef..e8334dc 100644
--- a/src/nfa/dm/nfa_dm_api.cc
+++ b/src/nfa/dm/nfa_dm_api.cc
@@ -25,6 +25,7 @@
 
 #include <android-base/stringprintf.h>
 #include <base/logging.h>
+#include <log/log.h>
 
 #include "ndef_utils.h"
 #include "nfa_api.h"
@@ -939,6 +940,11 @@
     return (NFA_STATUS_INVALID_PARAM);
 
   size = NFC_HDR_SIZE + NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE + data_len;
+  /* Check for integer overflow */
+  if (size < data_len) {
+    android_errorWriteLog(0x534e4554, "120664978");
+    return NFA_STATUS_INVALID_PARAM;
+  }
   p_msg = (NFC_HDR*)GKI_getbuf(size);
   if (p_msg != nullptr) {
     p_msg->event = NFA_DM_API_RAW_FRAME_EVT;
diff --git a/src/nfc/tags/ce_t4t.cc b/src/nfc/tags/ce_t4t.cc
index f85d9b9..f807eb1 100644
--- a/src/nfc/tags/ce_t4t.cc
+++ b/src/nfc/tags/ce_t4t.cc
@@ -22,6 +22,7 @@
  *  mode.
  *
  ******************************************************************************/
+#include <log/log.h>
 #include <string.h>
 
 #include <android-base/stringprintf.h>
@@ -389,6 +390,14 @@
   /* Lc Byte */
   BE_STREAM_TO_UINT8(data_len, p_cmd);
 
+  /*CLS+INS+P1+P2+Lc+Data*/
+  if (data_len > (p_c_apdu->len - T4T_CMD_MAX_HDR_SIZE)) {
+    LOG(ERROR) << StringPrintf("Wrong length in ce_t4t_process_select_app_cmd");
+    android_errorWriteLog(0x534e4554, "115635871");
+    ce_t4t_send_status(T4T_RSP_WRONG_LENGTH);
+    GKI_freebuf(p_c_apdu);
+    return;
+  }
 #if (CE_TEST_INCLUDED == TRUE)
   if (mapping_aid_test_enabled) {
     if ((data_len == T4T_V20_NDEF_TAG_AID_LEN) &&
@@ -540,7 +549,7 @@
                               tNFC_CONN* p_data) {
   NFC_HDR* p_c_apdu;
   uint8_t* p_cmd;
-  uint8_t cla, instruct, select_type = 0, length;
+  uint8_t cla = 0, instruct = 0, select_type = 0, length = 0;
   uint16_t offset, max_file_size;
   tCE_DATA ce_data;
 
@@ -558,6 +567,14 @@
 
   p_cmd = (uint8_t*)(p_c_apdu + 1) + p_c_apdu->offset;
 
+  if (p_c_apdu->len == 0) {
+    LOG(ERROR) << StringPrintf("Wrong length in ce_t4t_data_cback");
+    android_errorWriteLog(0x534e4554, "115635871");
+    ce_t4t_send_status(T4T_RSP_WRONG_LENGTH);
+    if (p_c_apdu) GKI_freebuf(p_c_apdu);
+    return;
+  }
+
   /* Class Byte */
   BE_STREAM_TO_UINT8(cla, p_cmd);
 
@@ -570,16 +587,28 @@
     return;
   }
 
-  /* Instruction Byte */
-  BE_STREAM_TO_UINT8(instruct, p_cmd);
+  /*CLA+INS+P1+P2 = 4 bytes*/
+  if (p_c_apdu->len >= T4T_CMD_MIN_HDR_SIZE) {
+    /* Instruction Byte */
+    BE_STREAM_TO_UINT8(instruct, p_cmd);
 
-  if ((cla == T4T_CMD_CLASS) && (instruct == T4T_CMD_INS_SELECT)) {
-    /* P1 Byte */
-    BE_STREAM_TO_UINT8(select_type, p_cmd);
+    if ((cla == T4T_CMD_CLASS) && (instruct == T4T_CMD_INS_SELECT)) {
+      /* P1 Byte */
+      BE_STREAM_TO_UINT8(select_type, p_cmd);
 
-    if (select_type == T4T_CMD_P1_SELECT_BY_NAME) {
-      ce_t4t_process_select_app_cmd(p_cmd, p_c_apdu);
-      return;
+      if (select_type == T4T_CMD_P1_SELECT_BY_NAME) {
+        /*CLA+INS+P1+P2+Lc = 5 bytes*/
+        if (p_c_apdu->len >= T4T_CMD_MAX_HDR_SIZE) {
+          ce_t4t_process_select_app_cmd(p_cmd, p_c_apdu);
+          return;
+        } else {
+          LOG(ERROR) << StringPrintf("Wrong length in select app cmd");
+          android_errorWriteLog(0x534e4554, "115635871");
+          ce_t4t_send_status(T4T_RSP_NOT_FOUND);
+          if (p_c_apdu) GKI_freebuf(p_c_apdu);
+          return;
+        }
+      }
     }
   }
 
diff --git a/src/nfc/tags/rw_t2t_ndef.cc b/src/nfc/tags/rw_t2t_ndef.cc
index 44ae54b..707f86b 100644
--- a/src/nfc/tags/rw_t2t_ndef.cc
+++ b/src/nfc/tags/rw_t2t_ndef.cc
@@ -594,7 +594,12 @@
             break;
 
           case TAG_LOCK_CTRL_TLV:
-            p_t2t->bytes_count--;
+            if (p_t2t->bytes_count > 0) {
+              p_t2t->bytes_count--;
+            } else {
+              LOG(ERROR) << StringPrintf("Underflow p_t2t->bytes_count!");
+              android_errorWriteLog(0x534e4554, "120506143");
+            }
             if ((tlvtype == TAG_LOCK_CTRL_TLV) || (tlvtype == TAG_NDEF_TLV)) {
               /* Collect Lock TLV */
               p_t2t->tlv_value[2 - p_t2t->bytes_count] = p_data[offset];
@@ -642,7 +647,12 @@
             break;
 
           case TAG_MEM_CTRL_TLV:
-            p_t2t->bytes_count--;
+            if (p_t2t->bytes_count > 0) {
+              p_t2t->bytes_count--;
+            } else {
+              LOG(ERROR) << StringPrintf("bytes_count underflow!");
+              android_errorWriteLog(0x534e4554, "120506143");
+            }
             if ((tlvtype == TAG_MEM_CTRL_TLV) || (tlvtype == TAG_NDEF_TLV)) {
               p_t2t->tlv_value[2 - p_t2t->bytes_count] = p_data[offset];
               if (p_t2t->bytes_count == 0) {
@@ -674,7 +684,12 @@
             break;
 
           case TAG_PROPRIETARY_TLV:
-            p_t2t->bytes_count--;
+            if (p_t2t->bytes_count > 0) {
+              p_t2t->bytes_count--;
+            } else {
+              LOG(ERROR) << StringPrintf("bytes_count underflow!");
+              android_errorWriteLog(0x534e4554, "120506143");
+            }
             if (tlvtype == TAG_PROPRIETARY_TLV) {
               found = true;
               p_t2t->prop_msg_len = len;
diff --git a/src/nfc/tags/rw_t3t.cc b/src/nfc/tags/rw_t3t.cc
index 075c2d7..1341a81 100644
--- a/src/nfc/tags/rw_t3t.cc
+++ b/src/nfc/tags/rw_t3t.cc
@@ -26,6 +26,7 @@
 
 #include <android-base/stringprintf.h>
 #include <base/logging.h>
+#include <log/log.h>
 
 #include "nfc_target.h"
 
@@ -1246,6 +1247,10 @@
                       NCI_NFCID2_LEN) != 0)) /* verify response IDm */
   {
     evt_data.status = NFC_STATUS_FAILED;
+  } else if (p_msg_rsp->len <
+             (T3T_MSG_RSP_OFFSET_CHECK_DATA + T3T_MSG_BLOCKSIZE)) {
+    evt_data.status = NFC_STATUS_FAILED;
+    android_errorWriteLog(0x534e4554, "120428041");
   } else {
     /* Get checksum from received ndef attribute msg */
     p = &p_t3t_rsp[T3T_MSG_RSP_OFFSET_CHECK_DATA + T3T_MSG_NDEF_ATTR_INFO_SIZE];
@@ -1371,7 +1376,7 @@
         T3T_MSG_OPC_CHECK_RSP, p_t3t_rsp[T3T_MSG_RSP_OFFSET_RSPCODE]);
     nfc_status = NFC_STATUS_FAILED;
     GKI_freebuf(p_msg_rsp);
-  } else {
+  } else if (p_msg_rsp->len >= T3T_MSG_RSP_OFFSET_CHECK_DATA) {
     /* Copy incoming data into buffer */
     p_msg_rsp->offset +=
         T3T_MSG_RSP_OFFSET_CHECK_DATA; /* Skip over t3t header */
@@ -1381,6 +1386,10 @@
     tRW_DATA rw_data;
     rw_data.data = evt_data;
     (*(rw_cb.p_cback))(RW_T3T_CHECK_EVT, &rw_data);
+  } else {
+    android_errorWriteLog(0x534e4554, "120503926");
+    nfc_status = NFC_STATUS_FAILED;
+    GKI_freebuf(p_msg_rsp);
   }
 
   p_cb->rw_state = RW_T3T_STATE_IDLE;
@@ -1640,7 +1649,12 @@
 
     DLOG_IF(INFO, nfc_debug_enabled)
         << StringPrintf("FeliCa detected (RD, system code %04X)", sc);
-    p_cb->system_codes[p_cb->num_system_codes++] = sc;
+    if (p_cb->num_system_codes < T3T_MAX_SYSTEM_CODES) {
+      p_cb->system_codes[p_cb->num_system_codes++] = sc;
+    } else {
+      LOG(ERROR) << StringPrintf("Exceed T3T_MAX_SYSTEM_CODES!");
+      android_errorWriteLog(0x534e4554, "120499324");
+    }
   }
 
   rw_t3t_handle_get_system_codes_cplt();
@@ -1838,6 +1852,10 @@
                         NCI_NFCID2_LEN) != 0)) /* verify response IDm */
     {
       evt_data.status = NFC_STATUS_FAILED;
+    } else if (p_msg_rsp->len <
+               (T3T_MSG_RSP_OFFSET_CHECK_DATA + T3T_MSG_BLOCKSIZE)) {
+      evt_data.status = NFC_STATUS_FAILED;
+      android_errorWriteLog(0x534e4554, "120506143");
     } else {
       /* Check if memory configuration (MC) block to see if SYS_OP=1 (NDEF
        * enabled) */
@@ -2049,16 +2067,18 @@
                         NCI_NFCID2_LEN) != 0)) /* verify response IDm */
     {
       evt_data.status = NFC_STATUS_FAILED;
+    } else if (p_msg_rsp->len <
+               (T3T_MSG_RSP_OFFSET_CHECK_DATA + T3T_MSG_BLOCKSIZE)) {
+      evt_data.status = NFC_STATUS_FAILED;
+      android_errorWriteLog(0x534e4554, "120506143");
     } else {
       /* Check if memory configuration (MC) block to see if SYS_OP=1 (NDEF
        * enabled) */
       p_mc = &p_t3t_rsp[T3T_MSG_RSP_OFFSET_CHECK_DATA]; /* Point to MC data of
                                                            CHECK response */
 
-      if (p_mc[T3T_MSG_FELICALITE_MC_OFFSET_SYS_OP] != 0x01) {
-        /* Tag is not currently enabled for NDEF */
-        evt_data.status = NFC_STATUS_FAILED;
-      } else {
+      evt_data.status = NFC_STATUS_FAILED;
+      if (p_mc[T3T_MSG_FELICALITE_MC_OFFSET_SYS_OP] == 0x01) {
         /* Set MC_SP field with MC[0] = 0x00 & MC[1] = 0xC0 (Hardlock) to change
          * access permission from RW to RO */
         p_mc[T3T_MSG_FELICALITE_MC_OFFSET_MC_SP] = 0x00;