| commit | 51d5daea85b763cdee3a3f441a9f68ed5b43a552 | [log] [tgz] |
|---|---|---|
| author | Suren Baghdasaryan <surenb@google.com> | Thu Aug 17 10:43:14 2017 -0700 |
| committer | Amit Pundir <amit.pundir@linaro.org> | Tue Aug 28 17:10:42 2018 +0530 |
| tree | 0752a447f045a09567d227a372ffde94d3431917 | |
| parent | 9d30b77414296d08f4a63c14912f9213a0b00361 [diff] |
ANDROID: NFC: st21nfca: Fix out of bounds kernel access when handling ATR_REQ Out of bounds kernel accesses in st21nfca's NFC HCI layer might happen when handling ATR_REQ events if user-specified atr_req->length is bigger than the buffer size. In that case memcpy() inside st21nfca_tm_send_atr_res() will read extra bytes resulting in OOB read from the kernel heap. Bug: 62679012 Signed-off-by: Suren Baghdasaryan <surenb@google.com>