commit 99dcb4312dbe28fb7f102344c707dab82e8bf9cb
author Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Sat May 27 17:14:33 2023 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Sat May 27 17:14:33 2023 +0000
tree b04fde473c79ffb8b4d5779330228b7d7067f71a
parent 071d6967ff27d80d9aef354080ff35e004286cc3
parent 29a655b55babcacd71a830d2d64d153e37b0be9e

Merge cherrypicks of ['googleplex-android-review.googlesource.com/22977056'] into tm-qpr3-release.

Change-Id: Ic6d95e420200403c32bc7def1043b8198f171fbe

src/nfc/tags/rw_i93.cc

diff --git a/src/nfc/tags/rw_i93.cc b/src/nfc/tags/rw_i93.cc
index 2b246e8..4056a02 100644
--- a/src/nfc/tags/rw_i93.cc
+++ b/src/nfc/tags/rw_i93.cc
@@ -540,6 +540,15 @@
     case I93_CMD_GET_MULTI_BLK_SEC:
     case I93_CMD_EXT_GET_MULTI_BLK_SEC:
 
+      if (UINT16_MAX - length < NFC_HDR_SIZE) {
+        rw_data.i93_cmd_cmpl.status = NFC_STATUS_FAILED;
+        rw_data.i93_cmd_cmpl.command = p_i93->sent_cmd;
+        rw_cb.tcb.i93.sent_cmd = 0;
+
+        event = RW_I93_CMD_CMPL_EVT;
+        break;
+      }
+
       /* forward tag data or security status */
       p_buff = (NFC_HDR*)GKI_getbuf((uint16_t)(length + NFC_HDR_SIZE));