Merge branch 'security-aosp-pi-release' into int/p/fp2
* security-aosp-pi-release:
OOBW in phNxpNciHal_process_ext_rsp
Change-Id: I3613ddab111010cb70df588d924c1c53da53e07b
diff --git a/halimpl/hal/phNxpNciHal_ext.cc b/halimpl/hal/phNxpNciHal_ext.cc
index bc3f7ec..c8c4c18 100755
--- a/halimpl/hal/phNxpNciHal_ext.cc
+++ b/halimpl/hal/phNxpNciHal_ext.cc
@@ -258,6 +258,11 @@
icode_send_eof = 0;
}
if (nxpncihal_ctrl.nci_info.nci_version != NCI_VERSION_2_0) {
+ if (*p_len <= (p_ntf[2] + 2)) {
+ android_errorWriteLog(0x534e4554, "181660091");
+ NXPLOG_NCIHAL_E("length error!");
+ return NFCSTATUS_FAILED;
+ }
if (p_ntf[p_ntf[2] + 2] == 0x00) {
NXPLOG_NCIHAL_D("> Going through workaround - data of ISO 15693");
p_ntf[2]--;
@@ -274,8 +279,8 @@
icode_send_eof = 0;
} else if (*p_len == 4 && p_ntf[0] == 0x40 && p_ntf[1] == 0x02 &&
p_ntf[2] == 0x01 && p_ntf[3] == 0x06) {
- NXPLOG_NCIHAL_D("> Deinit workaround for LLCP set_config 0x%x 0x%x 0x%x",
- p_ntf[21], p_ntf[22], p_ntf[23]);
+ /* NXPLOG_NCIHAL_D("> Deinit workaround for LLCP set_config 0x%x 0x%x 0x%x",
+ p_ntf[21], p_ntf[22], p_ntf[23]); */
p_ntf[0] = 0x40;
p_ntf[1] = 0x02;
p_ntf[2] = 0x02;