diff options
| author | George Chang <georgekgchang@google.com> | 2020-02-20 18:03:23 +0800 |
|---|---|---|
| committer | George Chang <georgekgchang@google.com> | 2020-02-21 20:49:42 +0800 |
| commit | 9e2d8a17571c6a62cc6db669e51147582632bb0b (patch) | |
| tree | 50d4ae066712473745dcfaa9bf955cc5836a8dcf | |
| parent | f384f95bfe983c90d6d549388bbc903ac8f50c3b (diff) | |
| download | android_hardware_nxp_nfc-9e2d8a17571c6a62cc6db669e51147582632bb0b.tar.gz android_hardware_nxp_nfc-9e2d8a17571c6a62cc6db669e51147582632bb0b.tar.bz2 android_hardware_nxp_nfc-9e2d8a17571c6a62cc6db669e51147582632bb0b.zip | |
Prevent potential OOB in phNxpNciHal_NfcDep_cmd_ext
Bug: 139736125
Bug: 139532977
Test: manual
Change-Id: I4a103fb3e503c6cc22181fd4370664ecdec41eb8
| -rwxr-xr-x | halimpl/hal/phNxpNciHal_NfcDepSWPrio.cc | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/halimpl/hal/phNxpNciHal_NfcDepSWPrio.cc b/halimpl/hal/phNxpNciHal_NfcDepSWPrio.cc index 6e0c6e6..19c5c01 100755 --- a/halimpl/hal/phNxpNciHal_NfcDepSWPrio.cc +++ b/halimpl/hal/phNxpNciHal_NfcDepSWPrio.cc @@ -23,6 +23,8 @@ #define CLEAN_UP_TIMEOUT 250 #define MAX_WRITE_RETRY 5 +#define MAX_POLL_CMD_LEN 64 +#define NCI_HEADER_SIZE 3 /******************* Global variables *****************************************/ extern phNxpNciHal_Control_t nxpncihal_ctrl; extern NFCSTATUS phNxpNciHal_send_ext_cmd(uint16_t cmd_len, uint8_t* p_cmd); @@ -33,7 +35,7 @@ static uint8_t cmd_resume_rf_discovery[] = {0x21, 0x06, 0x01, /*RF_DISCOVER_SELECT_CMD*/ static uint8_t cmd_select_rf_discovery[] = {0x21, 0x04, 0x03, 0x01, 0x04, 0x02}; -static uint8_t cmd_poll[64]; +static uint8_t cmd_poll[MAX_POLL_CMD_LEN]; static uint8_t cmd_poll_len = 0; int discover_type = 0xFF; uint32_t cleanup_timer; @@ -509,11 +511,16 @@ NFCSTATUS phNxpNciHal_select_RF_Discovery(unsigned int RfID, ** *******************************************************************************/ void phNxpNciHal_NfcDep_cmd_ext(uint8_t* p_cmd_data, uint16_t* cmd_len) { + if (*cmd_len < NCI_HEADER_SIZE) return; if (p_cmd_data[0] == 0x21 && p_cmd_data[1] == 0x03) { if (*cmd_len == 6 && p_cmd_data[3] == 0x01 && p_cmd_data[4] == 0x02 && p_cmd_data[5] == 0x01) { /* DO NOTHING */ } else { + if (*cmd_len > MAX_POLL_CMD_LEN) { + NXPLOG_NCIHAL_E("invalid cmd_len"); + return; + } /* Store the polling loop configuration */ cmd_poll_len = *cmd_len; memset(&cmd_poll, 0, cmd_poll_len); |