commit 0d7103d5cc796959b00b986d9aa2b29e2f97dfe4
author Alisher Alikhodjaev <alisher@google.com> Fri Mar 18 17:13:05 2022 -0700
committer Karsten Tausche <karsten@fairphone.com> Thu Nov 10 11:00:17 2022 +0100
tree 434e521724f7ad950cd045e5c4a507de34de4ef9
parent f9f17d91c7c66c33a8d1160d222a2acbb1813e16

OOB read in phNciNfc_RecvMfResp()

The size of RspBuff for Mifare shall be at least 2 bytes:
Mifare Req/Rsp Id + Status

Bug: 221852424
Test: build ok
Change-Id: I3a1e10997de8d2a7cb8bbb524fc8788aaf97944e
(cherry picked from commit f0d86f7fe23499cd4c6631348618463fbc496436)
Merged-In: I3a1e10997de8d2a7cb8bbb524fc8788aaf97944e
Issue: FP3SEC-401
[Port to NXP: Apply to SN100x as well.]
(cherry picked from commit 2a58d092dac79fba1fecee18fd39c671261951dc)

nci/SN100x/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp

diff --git a/nci/SN100x/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp b/nci/SN100x/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
index d591211..a7640e4 100644
--- a/nci/SN100x/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
+++ b/nci/SN100x/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
@@ -1143,8 +1143,9 @@
   if (NULL == RspBuffInfo) {
     status = NFCSTATUS_FAILED;
   } else {
-    if ((0 == (RspBuffInfo->wLen)) || (PH_NCINFC_STATUS_OK != wStatus) ||
-        (NULL == (RspBuffInfo->pBuff))) {
+    if (((PHNCINFC_EXTNID_SIZE + PHNCINFC_EXTNSTATUS_SIZE) >
+         RspBuffInfo->wLen) ||
+        (PH_NCINFC_STATUS_OK != wStatus) || (NULL == (RspBuffInfo->pBuff))) {
       status = NFCSTATUS_FAILED;
     } else {
       RecvdExtnRspId = (phNciNfc_ExtnRespId_t)RspBuffInfo->pBuff[0];

nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp

diff --git a/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp b/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
index dd076d8..ffbd24d 100644
--- a/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
+++ b/nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
@@ -1130,8 +1130,9 @@
   if (NULL == RspBuffInfo) {
     status = NFCSTATUS_FAILED;
   } else {
-    if ((0 == (RspBuffInfo->wLen)) || (PH_NCINFC_STATUS_OK != wStatus) ||
-        (NULL == (RspBuffInfo->pBuff))) {
+    if (((PHNCINFC_EXTNID_SIZE + PHNCINFC_EXTNSTATUS_SIZE) >
+         RspBuffInfo->wLen) ||
+        (PH_NCINFC_STATUS_OK != wStatus) || (NULL == (RspBuffInfo->pBuff))) {
       status = NFCSTATUS_FAILED;
     } else {
       RecvdExtnRspId = (phNciNfc_ExtnRespId_t)RspBuffInfo->pBuff[0];