diff options
author | Treehugger Robot <android-test-infra-autosubmit@system.gserviceaccount.com> | 2023-06-21 11:04:12 +0000 |
---|---|---|
committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2023-06-21 11:04:12 +0000 |
commit | 0efc5a0b09e67d743b3465f4af3e3409da1f2853 (patch) | |
tree | dbe6a477ec6dd8d787a462e6c1a1a7b5dbf54f37 | |
parent | dda0694630b9837a2d824e28c7d553c5e54243f6 (diff) | |
parent | 0ade407804ddcde95c3ea115822592fc7c4cbae7 (diff) | |
download | secure_element-0efc5a0b09e67d743b3465f4af3e3409da1f2853.tar.gz |
Merge "Fix for potential OOB write due to missing boundary check." am: 1d59235c78 am: 4fedde4020 am: 3ff29ccaf3 am: 0d97c00448 am: 0234dd89da am: 0ade407804
Original change: https://android-review.googlesource.com/c/platform/hardware/nxp/secure_element/+/2628856
Change-Id: I75b338c8e2cf197e894bdf3d3fff5a11d53c00c4
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
-rwxr-xr-x | pn8x/libese-spi/p73/lib/phNxpEseDataMgr.cpp | 6 | ||||
-rwxr-xr-x | pn8x/libese-spi/p73/lib/phNxpEseProto7816_3.cpp | 11 | ||||
-rwxr-xr-x | snxxx/libese-spi/p73/lib/phNxpEseDataMgr.cpp | 4 |
3 files changed, 18 insertions, 3 deletions
diff --git a/pn8x/libese-spi/p73/lib/phNxpEseDataMgr.cpp b/pn8x/libese-spi/p73/lib/phNxpEseDataMgr.cpp index 0213e18..ef0ca3a 100755 --- a/pn8x/libese-spi/p73/lib/phNxpEseDataMgr.cpp +++ b/pn8x/libese-spi/p73/lib/phNxpEseDataMgr.cpp @@ -1,6 +1,6 @@ /****************************************************************************** * - * Copyright 2018 NXP + * Copyright 2018,2023 NXP * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -79,6 +79,10 @@ ESESTATUS phNxpEse_GetData(uint32_t* data_len, uint8_t** pbuffer) { * ******************************************************************************/ ESESTATUS phNxpEse_StoreDatainList(uint32_t data_len, uint8_t* pbuff) { + if (data_len > MAX_DATA_LEN) { + ALOGE("%s Data length causes oob write error", __FUNCTION__); + return ESESTATUS_INVALID_RECEIVE_LENGTH; + } phNxpEse_sCoreRecvBuff_List_t* newNode = NULL; newNode = (phNxpEse_sCoreRecvBuff_List_t*)phNxpEse_memalloc( diff --git a/pn8x/libese-spi/p73/lib/phNxpEseProto7816_3.cpp b/pn8x/libese-spi/p73/lib/phNxpEseProto7816_3.cpp index f7a1679..76de6b9 100755 --- a/pn8x/libese-spi/p73/lib/phNxpEseProto7816_3.cpp +++ b/pn8x/libese-spi/p73/lib/phNxpEseProto7816_3.cpp @@ -1,6 +1,6 @@ /****************************************************************************** * - * Copyright 2018 NXP + * Copyright 2018,2023 NXP * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -967,7 +967,7 @@ static ESESTATUS phNxpEseProto7816_ProcessResponse(void) { IDLE_STATE; phNxpEseProto7816_3_Var.timeoutCounter = PH_PROTO_7816_VALUE_ZERO; ALOGE("%s calling phNxpEse_StoreDatainList", __FUNCTION__); - phNxpEse_StoreDatainList(data_len, p_data); + status = phNxpEse_StoreDatainList(data_len, p_data); } } } @@ -1033,6 +1033,13 @@ static ESESTATUS TransceiveProcess(void) { &phNxpEseProto7816_3_Var.phNxpEseNextTx_Cntx, sizeof(phNxpEseProto7816_NextTx_Info_t)); status = phNxpEseProto7816_ProcessResponse(); + if (ESESTATUS_NOT_ENOUGH_MEMORY == status || + ESESTATUS_INVALID_RECEIVE_LENGTH == status) { + ALOGE("%s Processing response failed, shall retry in new session", + __FUNCTION__); + phNxpEseProto7816_3_Var.phNxpEseProto7816_nextTransceiveState = + IDLE_STATE; + } } else { ALOGD_IF(ese_debug_enabled, "%s Transceive send failed, going to recovery!", __FUNCTION__); diff --git a/snxxx/libese-spi/p73/lib/phNxpEseDataMgr.cpp b/snxxx/libese-spi/p73/lib/phNxpEseDataMgr.cpp index 87af666..baf8afa 100755 --- a/snxxx/libese-spi/p73/lib/phNxpEseDataMgr.cpp +++ b/snxxx/libese-spi/p73/lib/phNxpEseDataMgr.cpp @@ -87,6 +87,10 @@ ESESTATUS phNxpEse_GetData(uint32_t* data_len, uint8_t** pbuffer) { * ******************************************************************************/ ESESTATUS phNxpEse_StoreDatainList(uint32_t data_len, uint8_t* pbuff) { + if (data_len > MAX_DATA_LEN) { + ALOGE("%s Data length causes oob write error", __FUNCTION__); + return ESESTATUS_INVALID_RECEIVE_LENGTH; + } phNxpEse_sCoreRecvBuff_List_t* newNode = NULL; newNode = (phNxpEse_sCoreRecvBuff_List_t*)phNxpEse_memalloc( |