DO NOT MERGE - Merge ab/7272582

Bug: 190855093
Merged-In: I98fbd6ac69ee89dadadae2f0553be47e3580a838
Change-Id: I65603d8b20919b302cdeebd58a1d8c71b2b45c13

2 files changed, 46 insertions, 7 deletions

diff --git a/pn8x/halimpl/hal/phNxpNciHal.cc b/pn8x/halimpl/hal/phNxpNciHal.cc
index 3a23e77..37b0aa3 100644
--- a/pn8x/halimpl/hal/phNxpNciHal.cc
+++ b/pn8x/halimpl/hal/phNxpNciHal.cc
@@ -3230,21 +3230,36 @@ static void phNxpNciHal_print_res_status(uint8_t* p_rx_data, uint16_t* p_len) {
       NXPLOG_NCIHAL_D("%s: response status =%s", __func__, response_buf[11]);
     }
     if (phNxpNciClock.isClockSet) {
-      int i;
-      for (i = 0; i < *p_len; i++) {
+      int i, len = sizeof(phNxpNciClock.p_rx_data);
+      if (*p_len > len) {
+        android_errorWriteLog(0x534e4554, "169257710");
+      } else {
+        len = *p_len;
+      }
+      for (i = 0; i < len; i++) {
         phNxpNciClock.p_rx_data[i] = p_rx_data[i];
       }
     }
 
     else if (phNxpNciRfSet.isGetRfSetting) {
-      int i;
-      for (i = 0; i < *p_len; i++) {
+      int i, len = sizeof(phNxpNciRfSet.p_rx_data);
+      if (*p_len > len) {
+        android_errorWriteLog(0x534e4554, "169258733");
+      } else {
+        len = *p_len;
+      }
+      for (i = 0; i < len; i++) {
         phNxpNciRfSet.p_rx_data[i] = p_rx_data[i];
         // NXPLOG_NCIHAL_D("%s: response status =0x%x",__func__,p_rx_data[i]);
       }
     } else if (phNxpNciMwEepromArea.isGetEepromArea) {
-      int i;
-      for (i = 8; i < *p_len; i++) {
+      int i, len = sizeof(phNxpNciMwEepromArea.p_rx_data) + 8;
+      if (*p_len > len) {
+        android_errorWriteLog(0x534e4554, "169258884");
+      } else {
+        len = *p_len;
+      }
+      for (i = 8; i < len; i++) {
         phNxpNciMwEepromArea.p_rx_data[i - 8] = p_rx_data[i];
       }
     } else if (nxpncihal_ctrl.phNxpNciGpioInfo.state == GPIO_STORE) {
diff --git a/pn8x/halimpl/hal/phNxpNciHal_ext.cc b/pn8x/halimpl/hal/phNxpNciHal_ext.cc
index 38548b3..3feaa01 100644
--- a/pn8x/halimpl/hal/phNxpNciHal_ext.cc
+++ b/pn8x/halimpl/hal/phNxpNciHal_ext.cc
@@ -143,6 +143,10 @@ NFCSTATUS phNxpNciHal_process_ext_rsp(uint8_t* p_ntf, uint16_t* p_len) {
   status = NFCSTATUS_SUCCESS;
 
   if (bDisableLegacyMfcExtns && bEnableMfcExtns && p_ntf[0] == 0) {
+    if (*p_len < NCI_HEADER_SIZE) {
+      android_errorWriteLog(0x534e4554, "169258743");
+      return NFCSTATUS_FAILED;
+    }
     uint16_t extlen;
     extlen = *p_len - NCI_HEADER_SIZE;
     NxpMfcReaderInstance.AnalyzeMfcResp(&p_ntf[3], &extlen);
@@ -415,24 +419,40 @@ static NFCSTATUS phNxpNciHal_ext_process_nfc_init_rsp(uint8_t* p_ntf,
   NFCSTATUS status = NFCSTATUS_SUCCESS;
 
   /* Parsing CORE_RESET_RSP and CORE_RESET_NTF to update NCI version.*/
-  if (p_ntf == NULL || *p_len == 0x00) {
+  if (p_ntf == NULL || *p_len < 2) {
     return NFCSTATUS_FAILED;
   }
   if (p_ntf[0] == NCI_MT_RSP &&
       ((p_ntf[1] & NCI_OID_MASK) == NCI_MSG_CORE_RESET)) {
+    if (*p_len < 4) {
+      android_errorWriteLog(0x534e4554, "169258455");
+      return NFCSTATUS_FAILED;
+    }
     if (p_ntf[2] == 0x01 && p_ntf[3] == 0x00) {
       NXPLOG_NCIHAL_D("CORE_RESET_RSP NCI2.0");
       if (nxpncihal_ctrl.hal_ext_enabled == TRUE) {
         nxpncihal_ctrl.nci_info.wait_for_ntf = TRUE;
       }
     } else if (p_ntf[2] == 0x03 && p_ntf[3] == 0x00) {
+      if (*p_len < 5) {
+        android_errorWriteLog(0x534e4554, "169258455");
+        return NFCSTATUS_FAILED;
+      }
       NXPLOG_NCIHAL_D("CORE_RESET_RSP NCI1.0");
       nxpncihal_ctrl.nci_info.nci_version = p_ntf[4];
     }
   } else if (p_ntf[0] == NCI_MT_NTF &&
              ((p_ntf[1] & NCI_OID_MASK) == NCI_MSG_CORE_RESET)) {
+    if (*p_len < 4) {
+      android_errorWriteLog(0x534e4554, "169258455");
+      return NFCSTATUS_FAILED;
+    }
     if (p_ntf[3] == CORE_RESET_TRIGGER_TYPE_CORE_RESET_CMD_RECEIVED ||
         p_ntf[3] == CORE_RESET_TRIGGER_TYPE_POWERED_ON) {
+      if (*p_len < 6) {
+        android_errorWriteLog(0x534e4554, "169258455");
+        return NFCSTATUS_FAILED;
+      }
       NXPLOG_NCIHAL_D("CORE_RESET_NTF NCI2.0 reason CORE_RESET_CMD received !");
       nxpncihal_ctrl.nci_info.nci_version = p_ntf[5];
       NXPLOG_NCIHAL_D("nci_version : 0x%02x",
@@ -475,6 +495,10 @@ static NFCSTATUS phNxpNciHal_ext_process_nfc_init_rsp(uint8_t* p_ntf,
       if (!nxpncihal_ctrl.hal_open_status) {
         phNxpNciHal_configFeatureList(p_ntf, *p_len);
       }
+      if (*p_len < 3) {
+        android_errorWriteLog(0x534e4554, "169258455");
+        return NFCSTATUS_FAILED;
+      }
       int len = p_ntf[2] + 2; /*include 2 byte header*/
       if (len != *p_len - 1) {
         NXPLOG_NCIHAL_E(