commit bc20e3efd5e0e06382a3a512e11be2300efde89c
author Bharath <Bharath.Prakash@harman.com> Tue Mar 21 17:43:26 2023 +0530
committer Bharath <Bharath.Prakash@harman.com> Tue Mar 21 17:43:26 2023 +0530
tree 0fe2605feec5e91527092a2d585af7957b30ae8e
parent ef443849df821340cf0734031e1d8fdf34a48efe
parent 2259cea3ac4f5c4528d6bca3129d61a9f96f9ee6

Merge branch 'dev/11/fp3/security-aosp-rvc-release' into int/11/fp3

* dev/11/fp3/security-aosp-rvc-release:
  OOBW in nci_snd_set_routing_cmd()

Change-Id: I600a91afb6b9d8f978e5026b1fb39ea8a1e38770

src/nfc/nci/nci_hmsgs.cc

diff --git a/src/nfc/nci/nci_hmsgs.cc b/src/nfc/nci/nci_hmsgs.cc
index 885ebaa..c191c26 100644
--- a/src/nfc/nci/nci_hmsgs.cc
+++ b/src/nfc/nci/nci_hmsgs.cc
@@ -630,6 +630,10 @@
   uint8_t* pp;
   uint8_t size = tlv_size + 2;
 
+  if (size < tlv_size) {
+    return (NCI_STATUS_FAILED);
+  }
+
   if (tlv_size == 0) {
     /* just to terminate routing table
      * 2 bytes (more=FALSE and num routing entries=0) */