| commit | 0aa296615188e551a10f7cb75af854df9416a1bc | [log] [tgz] |
|---|---|---|
| author | Alisher Alikhodjaev <alisher@google.com> | Tue Jan 31 19:04:09 2023 -0800 |
| committer | android-t1 <android-t1@t2mobile.com> | Sat May 06 10:37:44 2023 +0800 |
| tree | 552be59df06a6415b91794c952b13972befac9de | |
| parent | c19e5dbdc527f506340384bc2785874e30c249b0 [diff] |
OOBW in nci_snd_set_routing_cmd() Bug: 264879662 Test: read a tag, nfc on/off Change-Id: I408cf611fb35e9467d7484165ce48759970b158a (cherry picked from commit 1dd4d2e1b481dd83ca2b222993fdb74ae5306c78) Merged-In: I408cf611fb35e9467d7484165ce48759970b158a
diff --git a/src/nfc/nci/nci_hmsgs.cc b/src/nfc/nci/nci_hmsgs.cc index ed7caaa..81497c8 100644 --- a/src/nfc/nci/nci_hmsgs.cc +++ b/src/nfc/nci/nci_hmsgs.cc
@@ -632,6 +632,10 @@ uint8_t* pp; uint8_t size = tlv_size + 2; + if (size < tlv_size) { + return (NCI_STATUS_FAILED); + } + if (tlv_size == 0) { /* just to terminate routing table * 2 bytes (more=FALSE and num routing entries=0) */