Merge cherrypicks of [9736358, 9736296, 9735406, 9736235, 9736059, 9736060, 9736236, 9736297, 9736298, 9735210, 9735309] into qt-qpr1-release
Change-Id: If333dfd21868ef01b7c68e86137bb8eaa38c9107
diff --git a/src/nfc/tags/rw_i93.cc b/src/nfc/tags/rw_i93.cc
index 495ee8f..132df3a 100644
--- a/src/nfc/tags/rw_i93.cc
+++ b/src/nfc/tags/rw_i93.cc
@@ -2656,12 +2656,20 @@
}
/* get buffer to store CC, zero length NDEF TLV and Terminator TLV */
- p_i93->p_update_data = (uint8_t*)GKI_getbuf(RW_I93_FORMAT_DATA_LEN);
+ /* Block size could be either 4 or 8 or 16 or 32 bytes */
+ /* Get buffer for the largest block size I93_MAX_BLOCK_LENGH */
+ p_i93->p_update_data = (uint8_t*)GKI_getbuf(I93_MAX_BLOCK_LENGH);
if (!p_i93->p_update_data) {
LOG(ERROR) << StringPrintf("Cannot allocate buffer");
rw_i93_handle_error(NFC_STATUS_FAILED);
break;
+ } else if (p_i93->block_size > RW_I93_FORMAT_DATA_LEN) {
+ /* Possible leaking information from previous NFC transactions */
+ /* Clear previous values */
+ memset(p_i93->p_update_data, I93_ICODE_TLV_TYPE_NULL,
+ I93_MAX_BLOCK_LENGH);
+ android_errorWriteLog(0x534e4554, "139738828");
}
p = p_i93->p_update_data;
