diff options
| author | George Chang <georgekgchang@google.com> | 2018-12-25 14:37:54 +0800 |
|---|---|---|
| committer | android-build-team Robot <android-build-team-robot@google.com> | 2019-03-15 23:10:27 +0000 |
| commit | 6436dc18c691c12a7d64f2ee4b341c14288ba8fa (patch) | |
| tree | d56e6fdda74e98552f1b7e9006320af5b107a710 | |
| parent | 98a5e361f37eebf947c0deafbc9b9648982b25f4 (diff) | |
| download | libnfc-nci-6436dc18c691c12a7d64f2ee4b341c14288ba8fa.tar.gz | |
Prevent Out of bound error in phNxpNciHal_process_ext_rsp
Bug: 118152591
Test: Nfc Enable/Disable, R/W, P2P
Change-Id: I53bfc1b7eca4c3306f20488dc5fb8ccf9ed0e330
(cherry picked from commit 5ff72ad602488ba0b8102d6054fd04cd2d6531ee)
| -rw-r--r-- | halimpl/pn54x/hal/phNxpNciHal_ext.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/halimpl/pn54x/hal/phNxpNciHal_ext.c b/halimpl/pn54x/hal/phNxpNciHal_ext.c index 8957e44..22160b4 100644 --- a/halimpl/pn54x/hal/phNxpNciHal_ext.c +++ b/halimpl/pn54x/hal/phNxpNciHal_ext.c @@ -13,6 +13,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ +#include <log/log.h> #include <phNxpNciHal_ext.h> #include <phNxpNciHal.h> #include <phTmlNfc.h> @@ -105,6 +106,17 @@ NFCSTATUS phNxpNciHal_process_ext_rsp (uint8_t *p_ntf, uint16_t *p_len) NFCSTATUS status = NFCSTATUS_SUCCESS; uint16_t rf_technology_length_param = 0; + if (p_ntf[0] == 0x61 && p_ntf[1] == 0x05 && *p_len < 14) + { + if (*p_len <= 6) + { + android_errorWriteLog(0x534e4554, "118152591"); + } + NXPLOG_NCIHAL_E("RF_INTF_ACTIVATED_NTF length error!"); + status = NFCSTATUS_FAILED; + return status; + } + if (p_ntf[0] == 0x61 && p_ntf[1] == 0x05 && p_ntf[4] == 0x03 && |