Merge cherrypicks of [7982564, 7982192, 7982565, 7981411, 7982522, 7982682, 7982193, 7982194, 7982523, 7982480, 7982623, 7981412, 7981413, 7982605, 7982606, 7982607, 7982608, 7981749, 7981750, 7981751, 7981752, 7981753, 7981754, 7982624, 7982394, 7982395, 7982625, 7982687, 7982566, 7982567, 7982568, 7982688, 7982689, 7982690, 7982195, 7982196, 7982611, 7982612, 7982396, 7982694, 7982695, 7982215] into pi-qpr3-releaseandroid-9.0.0_r46pie-qpr3-release

Change-Id: Ic6206245f04e926ea564036009376f1cd3eababe

1 files changed, 15 insertions, 0 deletions

diff --git a/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp b/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
index 1261c3fc..9f04c18b 100644
--- a/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
+++ b/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
@@ -16,6 +16,7 @@
 
 #include <android-base/stringprintf.h>
 #include <base/logging.h>
+#include <log/log.h>
 #include <nfc_api.h>
 #include <nfc_int.h>
 #include <phNfcCompId.h>
@@ -993,12 +994,21 @@ NFCSTATUS Mfc_Transceive(uint8_t* p_data, uint32_t len) {
   NFCSTATUS status = NFCSTATUS_FAILED;
   uint8_t i = 0x00;
 
+  if (len == 0) {
+    android_errorWriteLog(0x534e4554, "132082342");
+    return status;
+  }
+
   gphNxpExtns_Context.RawWriteCallBack = false;
   gphNxpExtns_Context.CallBackMifare = NULL;
   gphNxpExtns_Context.CallBackCtxt = NdefMap;
 
   EXTNS_SetCallBackFlag(true);
   if (p_data[0] == 0x60 || p_data[0] == 0x61) {
+    if (len < 12) {
+      android_errorWriteLog(0x534e4554, "125900276");
+      return status;
+    }
     NdefMap->Cmd.MfCmd = (phNfc_eMifareCmdList_t)p_data[0];
 
     NdefMap->SendRecvBuf[i++] = p_data[1];
@@ -1857,6 +1867,11 @@ NFCSTATUS phFriNfc_ExtnsTransceive(phNfc_sTransceiveInfo_t* pTransceiveInfo,
       0x00, 0x00, 0x00, 0x00,
   };
 
+  if (SendLength == 0) {
+    android_errorWriteLog(0x534e4554, "132083376");
+    return status;
+  }
+
   buff = (uint8_t*)malloc((uint32_t)MAX_BUFF_SIZE);
   if (NULL == buff) {
     return status;