commit e326aee5de55f128cfd4cc7b476f3cbdb5ddfda5
author Alisher Alikhodjaev <alisher@google.com> Tue Mar 08 17:27:34 2022 -0800
committer Karsten Tausche <karsten@fairphone.com> Thu Nov 10 11:05:32 2022 +0100
tree 25d6fbd21979cefaf87dde9d0be35d2af42b599f
parent c22ebe137e2933bdd609bc457510422bc4faf041

Double Free in ce_t4t_data_cback

Bug: 221862119
Test: build ok
Change-Id: If12f98033b8c1bc1b57b27d338fa33b6a3cce640
(cherry picked from commit 2fcf7d677bcebae5a00db43938460bcce267149e)
Merged-In: If12f98033b8c1bc1b57b27d338fa33b6a3cce640
Issue: FP3SEC-403
[Port to NXP: Apply to SN100x as well.]
(cherry picked from commit 889cd417b9bd9ab880db23cba441128dede7e675)

SN100x/src/nfc/tags/ce_t4t.cc

diff --git a/SN100x/src/nfc/tags/ce_t4t.cc b/SN100x/src/nfc/tags/ce_t4t.cc
index 50c2f3e..268dbc3 100755
--- a/SN100x/src/nfc/tags/ce_t4t.cc
+++ b/SN100x/src/nfc/tags/ce_t4t.cc
@@ -651,6 +651,7 @@
     } else {
       GKI_freebuf(p_c_apdu);
       ce_t4t_send_status(T4T_RSP_NOT_FOUND);
+      return;
     }
   } else if (ce_cb.mem.t4t.status & CE_T4T_STATUS_WILDCARD_AID_SELECTED) {
     DLOG_IF(INFO, nfc_debug_enabled)

src/nfc/tags/ce_t4t.cc

diff --git a/src/nfc/tags/ce_t4t.cc b/src/nfc/tags/ce_t4t.cc
index 05ba156..1f1dc41 100644
--- a/src/nfc/tags/ce_t4t.cc
+++ b/src/nfc/tags/ce_t4t.cc
@@ -633,6 +633,7 @@
     } else {
       GKI_freebuf(p_c_apdu);
       ce_t4t_send_status(T4T_RSP_NOT_FOUND);
+      return;
     }
   } else if (ce_cb.mem.t4t.status & CE_T4T_STATUS_WILDCARD_AID_SELECTED) {
     DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("CET4T: Forward raw frame to wildcard AID handler");