diff options
| author | George Chang <georgekgchang@google.com> | 2020-03-26 13:39:19 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2020-03-26 13:39:19 +0000 |
| commit | b2e9acf4eb6b04402c6ced50fcd9806566c7f7d1 (patch) | |
| tree | 40ac2ff01abcf3df5061515401166cfe965b2882 | |
| parent | fe643c6403a179faf26803bc203b6e821db02acd (diff) | |
| parent | 95ff95f8e286fc244d95bf8783410d03272c63a8 (diff) | |
| download | android_hardware_nxp_nfc-b2e9acf4eb6b04402c6ced50fcd9806566c7f7d1.tar.gz android_hardware_nxp_nfc-b2e9acf4eb6b04402c6ced50fcd9806566c7f7d1.tar.bz2 android_hardware_nxp_nfc-b2e9acf4eb6b04402c6ced50fcd9806566c7f7d1.zip | |
Merge "Prevent OOB write in phNxpNciHal_write_ext" into qt-qpr1-dev
| -rwxr-xr-x | halimpl/hal/phNxpNciHal_ext.cc | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/halimpl/hal/phNxpNciHal_ext.cc b/halimpl/hal/phNxpNciHal_ext.cc index 1bbd25f..f9b92f8 100755 --- a/halimpl/hal/phNxpNciHal_ext.cc +++ b/halimpl/hal/phNxpNciHal_ext.cc @@ -664,7 +664,8 @@ NFCSTATUS phNxpNciHal_write_ext(uint16_t* cmd_len, uint8_t* p_cmd_data, } } - if (retval == 0x01 && p_cmd_data[0] == 0x21 && p_cmd_data[1] == 0x00) { + if (*cmd_len <= (NCI_MAX_DATA_LEN - 3) && + retval == 0x01 && p_cmd_data[0] == 0x21 && p_cmd_data[1] == 0x00) { NXPLOG_NCIHAL_D("Going through extns - Adding Mifare in RF Discovery"); p_cmd_data[2] += 3; p_cmd_data[3] += 1; @@ -774,7 +775,8 @@ NFCSTATUS phNxpNciHal_write_ext(uint16_t* cmd_len, uint8_t* p_cmd_data, phNxpNciHal_print_packet("RECV", p_rsp_data, 5); // status = NFCSTATUS_FAILED; NXPLOG_NCIHAL_D("> Going through workaround - Dirty Set Config - End "); - } else if (p_cmd_data[0] == 0x21 && p_cmd_data[1] == 0x00) { + } else if (*cmd_len <= (NCI_MAX_DATA_LEN - 3) && + p_cmd_data[0] == 0x21 && p_cmd_data[1] == 0x00) { NXPLOG_NCIHAL_D( "> Going through workaround - Add Mifare Classic in Discovery Map"); p_cmd_data[*cmd_len] = 0x80; |