Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e5141eef authored by Martijn Coenen's avatar Martijn Coenen Committed by Android Git Automerger
Browse files

am 4c5f2a9d: am ed1c8d7d: am 0aa1017f: Prevent allocation overflows by corrupt NDEF records.

* commit '4c5f2a9d':
  Prevent allocation overflows by corrupt NDEF records.
parents 873057b3 4c5f2a9d
Loading
Loading
Loading
Loading
+13 −0
Original line number Diff line number Diff line
@@ -102,6 +102,19 @@ static jint android_nfc_NdefMessage_parseNdefMessage(JNIEnv *e, jobject o,
        }
        TRACE("phFriNfc_NdefRecord_Parse() returned 0x%04x", status);

        // We don't exactly know what *is* a valid length, but a simple
        // sanity check is to make sure that the length of the header
        // plus all fields does not exceed raw_msg_size. The min length
        // of the header is 3 bytes: TNF, Type Length, Payload Length
        // (ID length field is optional!)
        uint64_t indicatedMsgLength = 3 + record.TypeLength + record.IdLength +
                (uint64_t)record.PayloadLength;
        if (indicatedMsgLength >
                (uint64_t)raw_msg_size) {
            LOGE("phFri_NdefRecord_Parse: invalid length field");
            goto end;
        }

        type = e->NewByteArray(record.TypeLength);
        if (type == NULL) {
            LOGD("NFC_Set Record Type Error\n");