mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
59bf3b75c7
https://review.lineageos.org/c/LineageOS/android_frameworks_base/+/353117 https://review.lineageos.org/q/topic:Q_asb_2023-03 https://review.lineageos.org/q/topic:Q_asb_2023-04 https://review.lineageos.org/q/topic:Q_asb_2023-05 https://review.lineageos.org/q/topic:Q_asb_2023-06 https://review.lineageos.org/q/topic:Q_asb_2023-07 https://review.lineageos.org/q/topic:Q_asb_2023-08 accounted for via patches: https://review.lineageos.org/c/LineageOS/android_system_ca-certificates/+/376560 https://review.lineageos.org/c/LineageOS/android_system_ca-certificates/+/376561 https://review.lineageos.org/c/LineageOS/android_system_ca-certificates/+/376562 https://review.lineageos.org/q/topic:Q_asb_2023-09 https://review.lineageos.org/q/topic:Q_asb_2023-10 https://review.lineageos.org/q/topic:Q_asb_2023-11 accounted for via patches: https://review.lineageos.org/c/LineageOS/android_system_ca-certificates/+/376563 accounted for via manifest change: https://review.lineageos.org/c/LineageOS/android_external_webp/+/376568 https://review.lineageos.org/q/topic:Q_asb_2023-12 https://review.lineageos.org/q/topic:Q_asb_2024-01 https://review.lineageos.org/q/topic:Q_asb_2024-02 https://review.lineageos.org/q/topic:Q_asb_2024-03 Signed-off-by: Tavi <tavi@divested.dev>
35 lines
1.2 KiB
Diff
35 lines
1.2 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Alisher Alikhodjaev <alisher@google.com>
|
|
Date: Tue, 2 May 2023 14:20:57 -0700
|
|
Subject: [PATCH] OOBW in rw_i93_send_to_upper()
|
|
|
|
Bug: 271849189
|
|
Test: tag r/w
|
|
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:dc9d09e1698725712628d394bf9be4c9003579e8)
|
|
Merged-In: I1d55954e56a3f995f8dd48bf484fe9fce02b2ed1
|
|
Change-Id: I1d55954e56a3f995f8dd48bf484fe9fce02b2ed1
|
|
---
|
|
src/nfc/tags/rw_i93.cc | 9 +++++++++
|
|
1 file changed, 9 insertions(+)
|
|
|
|
diff --git a/src/nfc/tags/rw_i93.cc b/src/nfc/tags/rw_i93.cc
|
|
index 1483cdc..1f48c27 100644
|
|
--- a/src/nfc/tags/rw_i93.cc
|
|
+++ b/src/nfc/tags/rw_i93.cc
|
|
@@ -516,6 +516,15 @@ void rw_i93_send_to_upper(NFC_HDR* p_resp) {
|
|
case I93_CMD_GET_MULTI_BLK_SEC:
|
|
case I93_CMD_EXT_GET_MULTI_BLK_SEC:
|
|
|
|
+ if (UINT16_MAX - length < NFC_HDR_SIZE) {
|
|
+ rw_data.i93_cmd_cmpl.status = NFC_STATUS_FAILED;
|
|
+ rw_data.i93_cmd_cmpl.command = p_i93->sent_cmd;
|
|
+ rw_cb.tcb.i93.sent_cmd = 0;
|
|
+
|
|
+ event = RW_I93_CMD_CMPL_EVT;
|
|
+ break;
|
|
+ }
|
|
+
|
|
/* forward tag data or security status */
|
|
p_buff = (NFC_HDR*)GKI_getbuf((uint16_t)(length + NFC_HDR_SIZE));
|
|
|