commit df6cbcd43f913350125e50081e0f92b709c727b9
author Jack Yu <jackcwyu@google.com> Wed Mar 04 17:57:57 2020 +0800
committer Jack Yu <jackcwyu@google.com> Mon Mar 23 04:02:10 2020 +0000
tree e11dd703ac338d5a14ac0d271c24e221715983a7
parent a705221ae525ec5d1935659db2daf4ff886fb818

Prevent stack buffer overflow in rw_t3t_message_set_block_list

Bug: 142280329
Test: build pass
Change-Id: Ib893ae490056824f9cde4be875475b1614c3eeb3
(cherry picked from commit ea7ce882ed1d8bc3755d3547d3fa61e922d01a56)

src/nfc/tags/rw_t3t.cc

diff --git a/src/nfc/tags/rw_t3t.cc b/src/nfc/tags/rw_t3t.cc
index 6ac933d..dce6ba8 100644
--- a/src/nfc/tags/rw_t3t.cc
+++ b/src/nfc/tags/rw_t3t.cc
@@ -1018,6 +1018,14 @@
 
       /* Add service code to T3T message */
       UINT16_TO_STREAM((*p), cur_service_code);
+
+      /* Validate num_services */
+      if (num_services >= T3T_MSG_SERVICE_LIST_MAX) {
+        LOG(ERROR) << StringPrintf(
+            "RW T3T: num_services (%i) reaches maximum (%i)", num_services,
+            T3T_MSG_SERVICE_LIST_MAX);
+        break;
+      }
     }
   }