diff options
| author | Jack Yu <jackcwyu@google.com> | 2018-11-07 20:19:21 +0800 |
|---|---|---|
| committer | Jack Yu <jackcwyu@google.com> | 2018-11-09 16:54:01 +0800 |
| commit | 006fb4bbfd06bd18afcaa008ebaf6e75ae3f649c (patch) | |
| tree | e737d0ee7d1834ee5ac51f965a031d221059e24c /halimpl/hal | |
| parent | 10b4693e8e9395514c551ea4647bdc56c6f95196 (diff) | |
| download | android_hardware_nxp_nfc-006fb4bbfd06bd18afcaa008ebaf6e75ae3f649c.tar.gz android_hardware_nxp_nfc-006fb4bbfd06bd18afcaa008ebaf6e75ae3f649c.tar.bz2 android_hardware_nxp_nfc-006fb4bbfd06bd18afcaa008ebaf6e75ae3f649c.zip | |
Prevent Out of bounds write in phNxpNciHal_ext_process_nfc_init_rsp()
Test: Nfc Enable/Disable; Android Beam; Tag reading
Bug: 117985575
Change-Id: Ifbdf16120c3f47f6811e2a4408073f1bc9fdc39c
Diffstat (limited to 'halimpl/hal')
| -rwxr-xr-x | halimpl/hal/phNxpNciHal_ext.cc | 10 |
1 files changed, 0 insertions, 10 deletions
diff --git a/halimpl/hal/phNxpNciHal_ext.cc b/halimpl/hal/phNxpNciHal_ext.cc index 646a07b..ee27d70 100755 --- a/halimpl/hal/phNxpNciHal_ext.cc +++ b/halimpl/hal/phNxpNciHal_ext.cc @@ -49,9 +49,6 @@ extern uint16_t wFwVer; uint16_t fw_maj_ver; uint16_t rom_version; -/* local buffer to store CORE_INIT response */ -static uint32_t bCoreInitRsp[40]; -static uint32_t iCoreInitRspLen; extern uint32_t timeoutTimerId; @@ -454,8 +451,6 @@ static NFCSTATUS phNxpNciHal_ext_process_nfc_init_rsp(uint8_t* p_ntf, wFwVerRsp = (((uint32_t)p_ntf[len - 2]) << 16U) | (((uint32_t)p_ntf[len - 1]) << 8U) | p_ntf[len]; if (wFwVerRsp == 0) status = NFCSTATUS_FAILED; - iCoreInitRspLen = *p_len; - memcpy(bCoreInitRsp, p_ntf, *p_len); NXPLOG_NCIHAL_D("NxpNci> FW Version: %x.%x.%x", p_ntf[len - 2], p_ntf[len - 1], p_ntf[len]); fw_maj_ver = p_ntf[len - 1]; @@ -846,11 +841,6 @@ NFCSTATUS phNxpNciHal_write_ext(uint16_t* cmd_len, uint8_t* p_cmd_data, /* CORE_INIT */ else if (p_cmd_data[0] == 0x20 && p_cmd_data[1] == 0x01 && p_cmd_data[2] == 0x00) { - // NXPLOG_NCIHAL_D("> Going - core init optimization"); - // *rsp_len = iCoreInitRspLen; - // memcpy(p_rsp_data, bCoreInitRsp, iCoreInitRspLen); - // status = NFCSTATUS_FAILED; - // NXPLOG_NCIHAL_D("> Going - core init optimization - END"); } } |