DivestOS/Patches/LineageOS-11.0/android_external_libnfc-nci/264097.patch

107 lines
5.0 KiB
Diff
Raw Normal View History

From 11f084f3bddf24d1747603363090ffab9217d7f3 Mon Sep 17 00:00:00 2001
From: George Chang <georgekgchang@google.com>
Date: Sun, 8 Sep 2019 22:55:33 +0800
Subject: [PATCH] Add boundary check in nfa_hci_handle_admin_gate_rsp
Bug: 124524315
Test: Nfc Enable/Disable with NFC SIM
Merged-In: Ic5b9398f7fc4f3aa8c83bd902e47d7785c5a6161
Change-Id: Ic5b9398f7fc4f3aa8c83bd902e47d7785c5a6161
Exempt-From-Owner-Approval: new owner approved
(cherry picked from commit dc58f77ff10e8a6502208249741ab6879c038bf1)
---
src/nfa/hci/nfa_hci_act.c | 31 +++++++++++++++++++++++++------
1 file changed, 25 insertions(+), 6 deletions(-)
diff --git a/src/nfa/hci/nfa_hci_act.c b/src/nfa/hci/nfa_hci_act.c
index 9a25cf6..c800a34 100644
--- a/src/nfa/hci/nfa_hci_act.c
+++ b/src/nfa/hci/nfa_hci_act.c
@@ -33,6 +33,7 @@
#include "nfa_nv_co.h"
#include "nfa_mem_co.h"
#include "nfa_hci_defs.h"
+#include <log/log.h>
/* Static local functions */
@@ -1405,8 +1406,8 @@ void nfa_hci_handle_admin_gate_rsp (UINT8 *p_data, UINT8 data_len)
}
else if (nfa_hci_cb.param_in_use == NFA_HCI_SESSION_IDENTITY_INDEX)
{
- /* The only parameter we get when initializing is the session ID. Check for match. */
- if (!memcmp ((UINT8 *) nfa_hci_cb.cfg.admin_gate.session_id, p_data, NFA_HCI_SESSION_ID_LEN) )
+ if (data_len >= NFA_HCI_SESSION_ID_LEN &&
+ !memcmp((uint8_t*)nfa_hci_cb.cfg.admin_gate.session_id, p_data, NFA_HCI_SESSION_ID_LEN))
{
/* Session has not changed. Set the WHITELIST */
nfa_hciu_send_set_param_cmd (NFA_HCI_ADMIN_PIPE, NFA_HCI_WHITELIST_INDEX, 0x02, hosts);
@@ -1416,6 +1417,10 @@ void nfa_hci_handle_admin_gate_rsp (UINT8 *p_data, UINT8 data_len)
/* Something wrong, NVRAM data could be corrupt or first start with default session id */
nfa_hciu_send_clear_all_pipe_cmd ();
nfa_hci_cb.b_hci_netwk_reset = TRUE;
+ if (data_len < NFA_HCI_SESSION_ID_LEN)
+ {
+ android_errorWriteLog(0x534e4554, "124524315");
+ }
}
}
break;
@@ -1466,7 +1471,8 @@ void nfa_hci_handle_admin_gate_rsp (UINT8 *p_data, UINT8 data_len)
case NFA_HCI_ANY_GET_PARAMETER:
if (nfa_hci_cb.param_in_use == NFA_HCI_SESSION_IDENTITY_INDEX)
{
- if (!memcmp ((UINT8 *) default_session, p_data , NFA_HCI_SESSION_ID_LEN))
+ if (data_len >= NFA_HCI_SESSION_ID_LEN &&
+ !memcmp((uint8_t*)default_session, p_data, NFA_HCI_SESSION_ID_LEN))
{
memcpy (&nfa_hci_cb.cfg.admin_gate.session_id[(NFA_HCI_SESSION_ID_LEN / 2)], nfa_hci_cb.cfg.admin_gate.session_id, (NFA_HCI_SESSION_ID_LEN / 2));
os_tick = GKI_get_os_tick_count ();
@@ -1476,6 +1482,10 @@ void nfa_hci_handle_admin_gate_rsp (UINT8 *p_data, UINT8 data_len)
}
else
{
+ if (data_len < NFA_HCI_SESSION_ID_LEN)
+ {
+ android_errorWriteLog(0x534e4554, "124524315");
+ }
if (nfa_hci_cb.hci_state == NFA_HCI_STATE_APP_DEREGISTER)
nfa_hci_api_deregister (NULL);
else if (nfa_hci_cb.hci_state == NFA_HCI_STATE_REMOVE_GATE)
@@ -1485,6 +1495,11 @@ void nfa_hci_handle_admin_gate_rsp (UINT8 *p_data, UINT8 data_len)
else if (nfa_hci_cb.param_in_use == NFA_HCI_HOST_LIST_INDEX)
{
evt_data.hosts.status = status;
+ if (data_len > NFA_HCI_MAX_HOST_IN_NETWORK)
+ {
+ data_len = NFA_HCI_MAX_HOST_IN_NETWORK;
+ android_errorWriteLog(0x534e4554, "124524315");
+ }
evt_data.hosts.num_hosts = data_len;
memcpy (evt_data.hosts.host, p_data, data_len);
@@ -1516,7 +1531,8 @@ void nfa_hci_handle_admin_gate_rsp (UINT8 *p_data, UINT8 data_len)
break;
case NFA_HCI_ADM_CREATE_PIPE:
- if (status == NFA_STATUS_OK)
+ // p_data should have at least 5 bytes length for pipe info
+ if (data_len >= 5 && status == NFA_STATUS_OK)
{
STREAM_TO_UINT8 (source_host, p_data);
STREAM_TO_UINT8 (source_gate, p_data);
@@ -1533,8 +1549,11 @@ void nfa_hci_handle_admin_gate_rsp (UINT8 *p_data, UINT8 data_len)
}
nfa_hciu_add_pipe_to_gate (pipe, source_gate, dest_host, dest_gate);
-
- }
+ } else if (data_len < 5 && status == NFA_STATUS_OK)
+ {
+ android_errorWriteLog(0x534e4554, "124524315");
+ status = NFA_STATUS_FAILED;
+ }
/* Tell the application his pipe was created or not */
evt_data.created.status = status;