diff options
| author | Alisher Alikhodjaev <alisher@google.com> | 2021-03-17 02:25:07 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2021-03-17 02:25:07 +0000 |
| commit | f84bcde30d0880630861108aaf3216a2c3317fdf (patch) | |
| tree | 68582d70fe3e8ac7e386d7fa6cba35c360e1d58f | |
| parent | e6b98902b84ecce080eee43ee55a0f9d00534f93 (diff) | |
| parent | 7cc62bb45c2c77612870f57246be9c3fa27c1253 (diff) | |
| download | platform_hardware_nxp_nfc-temp_ab_7272582.tar.gz platform_hardware_nxp_nfc-temp_ab_7272582.tar.bz2 platform_hardware_nxp_nfc-temp_ab_7272582.zip | |
Merge "An integer underflow vuln of nxp nfc hal library" into rvc-qpr-dev am: 7cc62bb45ctemp_ab_7272582
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/nxp/nfc/+/12902441
Change-Id: I89e50618a80b278d1dd9772373e155e71ca7e2ea
| -rw-r--r-- | halimpl/hal/phNxpNciHal_ext.cc | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/halimpl/hal/phNxpNciHal_ext.cc b/halimpl/hal/phNxpNciHal_ext.cc index 1dbf3ef..805aea6 100644 --- a/halimpl/hal/phNxpNciHal_ext.cc +++ b/halimpl/hal/phNxpNciHal_ext.cc @@ -143,6 +143,10 @@ NFCSTATUS phNxpNciHal_process_ext_rsp(uint8_t* p_ntf, uint16_t* p_len) { status = NFCSTATUS_SUCCESS; if (bDisableLegacyMfcExtns && bEnableMfcExtns && p_ntf[0] == 0) { + if (*p_len < NCI_HEADER_SIZE) { + android_errorWriteLog(0x534e4554, "169258743"); + return NFCSTATUS_FAILED; + } uint16_t extlen; extlen = *p_len - NCI_HEADER_SIZE; NxpMfcReaderInstance.AnalyzeMfcResp(&p_ntf[3], &extlen); |