Skip to content

Security Patches :D #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Megh-Rana wants to merge 4 commits into
base: 11
Choose a base branch
from
Open

Security Patches :D #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ebddae8
OOBW due to incorrect error handling
Oct 6, 2021
33f0b67
Do not set default contactless application without user interaction
Jan 13, 2022
eca8ad2
OOB read in phNciNfc_RecvMfResp()
Mar 19, 2022
4bc9393
Ensure that SecureNFC setting cannot be bypassed
Jun 1, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion nci/jni/NfcTag.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,6 +289,10 @@ void NfcTag::discoverTechnologies(tNFA_ACTIVATED& activationData) {

if (mTechListTail < (MAX_NUM_TECHNOLOGY - 1)) {
mNumTechList = mTechListTail;
} else {
LOG(ERROR) << StringPrintf("%s: exceed max=%d", fn, MAX_NUM_TECHNOLOGY);
android_errorWriteLog(0x534e4554, "189942532");
goto TheEnd;
}
mTechHandles[mNumTechList] = rfDetail.rf_disc_id;
mTechLibNfcTypes[mNumTechList] = rfDetail.protocol;
Expand Down Expand Up @@ -413,6 +417,7 @@ void NfcTag::discoverTechnologies(tNFA_ACTIVATED& activationData) {
<< StringPrintf("%s: index=%d; tech=%d; handle=%d; nfc type=%d", fn, i,
mTechList[i], mTechHandles[i], mTechLibNfcTypes[i]);
}
TheEnd:
DLOG_IF(INFO, nfc_debug_enabled) << StringPrintf("%s: exit", fn);
}

Expand Down Expand Up @@ -1624,4 +1629,4 @@ void NfcTag::setNumDiscNtf(int numDiscNtfValue) {
** Returns: number of discovery notifications received from NFCC
**
*******************************************************************************/
int NfcTag::getNumDiscNtf() { return mNumDiscNtf; }
int NfcTag::getNumDiscNtf() { return mNumDiscNtf; }
14 changes: 3 additions & 11 deletions nci/jni/extns/pn54x/src/mifare/phNxpExtns_MifareStd.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1117,8 +1117,9 @@ static NFCSTATUS phNciNfc_RecvMfResp(phNciNfc_Buff_t* RspBuffInfo,
if (NULL == RspBuffInfo) {
status = NFCSTATUS_FAILED;
} else {
if ((0 == (RspBuffInfo->wLen)) || (PH_NCINFC_STATUS_OK != wStatus) ||
(NULL == (RspBuffInfo->pBuff))) {
if (((PHNCINFC_EXTNID_SIZE + PHNCINFC_EXTNSTATUS_SIZE) >
RspBuffInfo->wLen) ||
(PH_NCINFC_STATUS_OK != wStatus) || (NULL == (RspBuffInfo->pBuff))) {
status = NFCSTATUS_FAILED;
} else {
RecvdExtnRspId = (phNciNfc_ExtnRespId_t)RspBuffInfo->pBuff[0];
Expand All @@ -1132,10 +1133,6 @@ static NFCSTATUS phNciNfc_RecvMfResp(phNciNfc_Buff_t* RspBuffInfo,
NdefMap->State == PH_FRINFC_NDEFMAP_STATE_WRITE ||
NdefMap->State == PH_FRINFC_NDEFMAP_STATE_WR_NDEF_LEN ||
NdefMap->State == PH_FRINFC_NDEFMAP_STATE_INIT)) {
if (2 > RspBuffInfo->wLen) {
android_errorWriteLog(0x534e4554, "181346550");
return NFCSTATUS_FAILED;
}
uint8_t rspAck = RspBuffInfo->pBuff[RspBuffInfo->wLen - 2];
uint8_t rspAckMask = ((RspBuffInfo->pBuff[RspBuffInfo->wLen - 1]) &
MAX_NUM_VALID_BITS_FOR_ACK);
Expand All @@ -1149,11 +1146,6 @@ static NFCSTATUS phNciNfc_RecvMfResp(phNciNfc_Buff_t* RspBuffInfo,
status = NFCSTATUS_SUCCESS;
uint16_t wRecvDataSz = 0;

if ((PHNCINFC_EXTNID_SIZE + PHNCINFC_EXTNSTATUS_SIZE) >
RspBuffInfo->wLen) {
android_errorWriteLog(0x534e4554, "181346550");
return NFCSTATUS_FAILED;
}
/* DataLen = TotalRecvdLen - (sizeof(RspId) + sizeof(Status)) */
wPldDataSize = ((RspBuffInfo->wLen) -
(PHNCINFC_EXTNID_SIZE + PHNCINFC_EXTNSTATUS_SIZE));
Expand Down
6 changes: 6 additions & 0 deletions src/com/android/nfc/NfcService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -916,6 +916,12 @@ void enforceBeamShareActivityPolicy(Context context, UserHandle uh) {
}
}

public boolean isSecureNfcEnabled() {
synchronized (NfcService.this) {
return mIsSecureNfcEnabled;
}
}

final class NfcAdapterService extends INfcAdapter.Stub {
/**
* An interface for vendor specific extensions
Expand Down
25 changes: 3 additions & 22 deletions src/com/android/nfc/cardemulation/CardEmulationManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,28 +262,9 @@ void verifyDefaults(int userId, List<ApduServiceInfo> services) {
getDefaultServiceForCategory(userId, CardEmulation.CATEGORY_PAYMENT, true);
if (DBG) Log.d(TAG, "Current default: " + defaultPaymentService);
if (defaultPaymentService == null) {
// A payment service may have been removed, leaving only one;
// in that case, automatically set that app as default.
int numPaymentServices = 0;
ComponentName lastFoundPaymentService = null;
for (ApduServiceInfo service : services) {
if (service.hasCategory(CardEmulation.CATEGORY_PAYMENT)) {
numPaymentServices++;
lastFoundPaymentService = service.getComponent();
}
}
if (numPaymentServices > 1) {
// More than one service left, leave default unset
if (DBG) Log.d(TAG, "No default set, more than one service left.");
} else if (numPaymentServices == 1) {
// Make single found payment service the default
if (DBG) Log.d(TAG, "No default set, making single service default.");
setDefaultServiceForCategoryChecked(userId, lastFoundPaymentService,
CardEmulation.CATEGORY_PAYMENT);
} else {
// No payment services left, leave default at null
if (DBG) Log.d(TAG, "No default set, last payment service removed.");
}
// A payment service may have been removed, set default payment selection to "not set".
if (DBG) Log.d(TAG, "No default set, last payment service removed.");
setDefaultServiceForCategoryChecked(userId, null, CardEmulation.CATEGORY_PAYMENT);
}
}

Expand Down
5 changes: 3 additions & 2 deletions src/com/android/nfc/cardemulation/HostEmulationManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,8 +174,9 @@ public void onHostEmulationData(byte[] data) {
// Resolve to default
// Check if resolvedService requires unlock
ApduServiceInfo defaultServiceInfo = resolveInfo.defaultService;
if (defaultServiceInfo.requiresUnlock() &&
mKeyguard.isKeyguardLocked() && mKeyguard.isKeyguardSecure()) {
if ((defaultServiceInfo.requiresUnlock()
|| NfcService.getInstance().isSecureNfcEnabled())
&& mKeyguard.isKeyguardLocked() && mKeyguard.isKeyguardSecure()) {
// Just ignore all future APDUs until next tap
mState = STATE_W4_DEACTIVATE;
launchTapAgain(resolveInfo.defaultService, resolveInfo.category);
Expand Down