external_libnfc-nci.patch

diff --git a/halimpl/pn54x/hal/phNxpNciHal_ext.c b/halimpl/pn54x/hal/phNxpNciHal_ext.c
index 893f986..1806800 100644
--- a/halimpl/pn54x/hal/phNxpNciHal_ext.c
+++ b/halimpl/pn54x/hal/phNxpNciHal_ext.c
@@ -13,6 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+#include <log/log.h>
 #include <phNxpNciHal_ext.h>
 #include <phNxpNciHal.h>
 #include <phTmlNfc.h>
@@ -109,6 +110,16 @@ NFCSTATUS phNxpNciHal_process_ext_rsp (uint8_t *p_ntf, uint16_t *p_len)
     NFCSTATUS status = NFCSTATUS_SUCCESS;
     uint16_t rf_technology_length_param = 0;
 
+    if (p_ntf[0] == 0x61 && p_ntf[1] == 0x05 && *p_len < 14) {
+        if(*p_len <= 6) {
+            android_errorWriteLog(0x534e4554, "118152591");
+        }
+        NXPLOG_NCIHAL_E("RF_INTF_ACTIVATED_NTF length error!");
+        status = NFCSTATUS_FAILED;
+        return status;
+    }
+
+
     if (p_ntf[0] == 0x61 &&
         p_ntf[1] == 0x05 &&
         p_ntf[4] == 0x03 &&
diff --git a/src/nfa/dm/nfa_dm_api.c b/src/nfa/dm/nfa_dm_api.c
index 89f667f..fb4bdf9 100644
--- a/src/nfa/dm/nfa_dm_api.c
+++ b/src/nfa/dm/nfa_dm_api.c
@@ -23,6 +23,7 @@
  *
  ******************************************************************************/
 #include <string.h>
+#include <log/log.h>
 #include "nfa_api.h"
 #include "nfa_sys.h"
 #include "nfa_dm_int.h"
@@ -869,6 +870,11 @@ tNFA_STATUS NFA_SendRawFrame (UINT8  *p_raw_data,
         return (NFA_STATUS_INVALID_PARAM);
 
     size = BT_HDR_SIZE + NCI_MSG_OFFSET_SIZE + NCI_DATA_HDR_SIZE + data_len;
+    /* Check for integer overflow */
+    if (size < data_len) {
+        android_errorWriteLog(0x534e4554, "120664978");
+        return NFA_STATUS_INVALID_PARAM;
+    }
     if ((p_msg = (BT_HDR *) GKI_getbuf (size)) != NULL)
     {
         p_msg->event  = NFA_DM_API_RAW_FRAME_EVT;
diff --git a/src/nfa/rw/nfa_rw_act.c b/src/nfa/rw/nfa_rw_act.c
index 5a1091d..3821e25 100644
--- a/src/nfa/rw/nfa_rw_act.c
+++ b/src/nfa/rw/nfa_rw_act.c
@@ -22,6 +22,7 @@
  *  This file contains the action functions the NFA_RW state machine.
  *
  ******************************************************************************/
+#include <log/log.h>
 #include <string.h>
 #include "nfa_rw_int.h"
 #include "nfa_dm_int.h"
@@ -77,9 +78,16 @@ static void nfa_rw_store_ndef_rx_buf (tRW_DATA *p_rw_data)
 
     p = (UINT8 *)(p_rw_data->data.p_data + 1) + p_rw_data->data.p_data->offset;
 
-    /* Save data into buffer */
-    memcpy(&nfa_rw_cb.p_ndef_buf[nfa_rw_cb.ndef_rd_offset], p, p_rw_data->data.p_data->len);
-    nfa_rw_cb.ndef_rd_offset += p_rw_data->data.p_data->len;
+    if ((nfa_rw_cb.ndef_rd_offset + p_rw_data->data.p_data->len) <=
+        nfa_rw_cb.ndef_cur_size) {
+      /* Save data into buffer */
+      memcpy(&nfa_rw_cb.p_ndef_buf[nfa_rw_cb.ndef_rd_offset], p,
+             p_rw_data->data.p_data->len);
+      nfa_rw_cb.ndef_rd_offset += p_rw_data->data.p_data->len;
+    } else {
+      NFA_TRACE_ERROR0("RW_SetActivatedTagType failed.");
+      android_errorWriteLog(0x534e4554, "123583388");
+    }
 
     GKI_freebuf(p_rw_data->data.p_data);
     p_rw_data->data.p_data = NULL;
diff --git a/src/nfc/llcp/llcp_dlc.c b/src/nfc/llcp/llcp_dlc.c
index 95bcac5..c8a300b 100644
--- a/src/nfc/llcp/llcp_dlc.c
+++ b/src/nfc/llcp/llcp_dlc.c
@@ -26,6 +26,7 @@
 #include <string.h>
 #include "gki.h"
 #include "nfc_target.h"
+#include <log/log.h>
 #include "bt_types.h"
 #include "llcp_int.h"
 #include "llcp_defs.h"
@@ -883,6 +884,15 @@ void llcp_dlc_proc_i_pdu (UINT8 dsap, UINT8 ssap, UINT16 i_pdu_length, UINT8 *p_
             p_i_pdu = (UINT8 *) (p_msg + 1) + p_msg->offset;
         }
 
+	if (i_pdu_length < LLCP_PDU_HEADER_SIZE + LLCP_SEQUENCE_SIZE) {
+            android_errorWriteLog(0x534e4554, "116722267");
+            LOG(ERROR) << StringPrintf("Insufficient I PDU length %d", i_pdu_length);
+            if (p_msg) {
+                GKI_freebuf(p_msg);
+            }
+            return;
+        }
+
         info_len = i_pdu_length - LLCP_PDU_HEADER_SIZE - LLCP_SEQUENCE_SIZE;
 
         if (info_len > p_dlcb->local_miu)
@@ -1088,6 +1098,10 @@ static void llcp_dlc_proc_rr_rnr_pdu (UINT8 dsap, UINT8 ptype, UINT8 ssap, UINT1
     {
         error_flags = 0;
 
+        if (length == 0) {
+            android_errorWriteLog(0x534e4554, "116788646");
+            return;
+        }
         rcv_seq = LLCP_GET_NR (*p_data);
 
         if (length != LLCP_PDU_RR_SIZE - LLCP_PDU_HEADER_SIZE)
diff --git a/src/nfc/llcp/llcp_link.c b/src/nfc/llcp/llcp_link.c
index d70349c..5153b74 100644
--- a/src/nfc/llcp/llcp_link.c
+++ b/src/nfc/llcp/llcp_link.c
@@ -23,6 +23,7 @@
  *
  ******************************************************************************/
 
+#include <log/log.h>
 #include <string.h>
 #include "gki.h"
 #include "nfc_target.h"
@@ -1132,7 +1133,7 @@ static void llcp_link_proc_agf_pdu (BT_HDR *p_agf)
 {
     UINT16 agf_length;
     UINT8 *p, *p_info, *p_pdu_length;
-    UINT16 pdu_hdr, pdu_length;
+    UINT16 pdu_hdr, pdu_length, pdu_num;
     UINT8  dsap, ptype, ssap;
 
     p_agf->len    -= LLCP_PDU_HEADER_SIZE;
@@ -1143,12 +1144,17 @@ static void llcp_link_proc_agf_pdu (BT_HDR *p_agf)
     */
     agf_length = p_agf->len;
     p = (UINT8 *) (p_agf + 1) + p_agf->offset;
+    pdu_num = 0;
 
     while (agf_length > 0)
     {
         if (agf_length > LLCP_PDU_AGF_LEN_SIZE)
         {
             BE_STREAM_TO_UINT16 (pdu_length, p);
+	    if (pdu_length < LLCP_PDU_HEADER_SIZE) {
+                LOG(ERROR) << StringPrintf("Received invalid encapsulated PDU");
+                break;
+            }
             agf_length -= LLCP_PDU_AGF_LEN_SIZE;
         }
         else
@@ -1159,6 +1165,7 @@ static void llcp_link_proc_agf_pdu (BT_HDR *p_agf)
         if (pdu_length <= agf_length)
         {
             p += pdu_length;
+	    pdu_num++;
             agf_length -= pdu_length;
         }
         else
@@ -1167,8 +1174,9 @@ static void llcp_link_proc_agf_pdu (BT_HDR *p_agf)
         }
     }
 
-    if (agf_length != 0)
+    if (agf_length != 0 || pdu_num < 2)
     {
+	android_errorWriteLog(0x534e4554, "116791157");
         LLCP_TRACE_ERROR0 ("llcp_link_proc_agf_pdu (): Received invalid AGF PDU");
         GKI_freebuf (p_agf);
         return;
@@ -1180,7 +1188,7 @@ static void llcp_link_proc_agf_pdu (BT_HDR *p_agf)
     agf_length = p_agf->len;
     p = (UINT8 *) (p_agf + 1) + p_agf->offset;
 
-    while (agf_length > 0)
+    while (agf_length > >= LLCP_PDU_HEADER_SIZE)
     {
         /* get length of PDU */
         p_pdu_length = p;
@@ -1207,7 +1215,8 @@ static void llcp_link_proc_agf_pdu (BT_HDR *p_agf)
             GKI_freebuf (p_agf);
             llcp_link_deactivate (LLCP_LINK_REMOTE_INITIATED);
             return;
-        }
+	} else if (ptype == LLCP_PDU_AGF_TYPE) {
+            LOG(ERROR) << StringPrintf("AGF PDU shall not be in AGF");
         else if (ptype == LLCP_PDU_SYMM_TYPE)
         {
             LLCP_TRACE_ERROR0 ("llcp_link_proc_agf_pdu (): SYMM PDU exchange shall not be in AGF");
diff --git a/src/nfc/llcp/llcp_util.c b/src/nfc/llcp/llcp_util.c
index 2f4420c..db2c25e 100644
--- a/src/nfc/llcp/llcp_util.c
+++ b/src/nfc/llcp/llcp_util.c
@@ -26,6 +26,7 @@
 #include <string.h>
 #include "gki.h"
 #include "nfc_target.h"
+#include <log/log.h>
 #include "bt_types.h"
 #include "trace_api.h"
 #include "llcp_int.h"
@@ -45,21 +46,34 @@ BOOLEAN llcp_util_parse_link_params (UINT16 length, UINT8 *p_bytes)
 {
     UINT8 param_type, param_len, *p = p_bytes;
 
-    while (length)
+    while (length >= 2)
     {
-        BE_STREAM_TO_UINT8 (param_type, p);
-        length--;
-
+        BE_STREAM_TO_UINT8(param_type, p);
+        BE_STREAM_TO_UINT8(param_len, p);
+        if (length < param_len + 2) {
+            android_errorWriteLog(0x534e4554, "114238578");
+            LOG(ERROR) << StringPrintf("Bad TLV's");
+            return false;
+        }
+        length -= param_len + 2;
         switch (param_type)
         {
         case LLCP_VERSION_TYPE:
-            BE_STREAM_TO_UINT8 (param_len, p);
+            if (param_len != LLCP_VERSION_LEN) {
+                android_errorWriteLog(0x534e4554, "114238578");
+                LOG(ERROR) << StringPrintf("Bad TLV's");
+                return false;
+            }
             BE_STREAM_TO_UINT8 (llcp_cb.lcb.peer_version, p);
             LLCP_TRACE_DEBUG1 ("Peer Version - 0x%02X", llcp_cb.lcb.peer_version);
             break;
 
         case LLCP_MIUX_TYPE:
-            BE_STREAM_TO_UINT8 (param_len, p);
+            if (param_len != LLCP_MIUX_LEN) {
+                android_errorWriteLog(0x534e4554, "114238578");
+                LOG(ERROR) << StringPrintf("Bad TLV's");
+                return false;
+            }
             BE_STREAM_TO_UINT16 (llcp_cb.lcb.peer_miu, p);
             llcp_cb.lcb.peer_miu &= LLCP_MIUX_MASK;
             llcp_cb.lcb.peer_miu += LLCP_DEFAULT_MIU;
@@ -67,38 +81,41 @@ BOOLEAN llcp_util_parse_link_params (UINT16 length, UINT8 *p_bytes)
             break;
 
         case LLCP_WKS_TYPE:
-            BE_STREAM_TO_UINT8 (param_len, p);
+            if (param_len != LLCP_WKS_LEN) {
+                android_errorWriteLog(0x534e4554, "114238578");
+                LOG(ERROR) << StringPrintf("Bad TLV's");
+                return false;
+            }
             BE_STREAM_TO_UINT16 (llcp_cb.lcb.peer_wks, p);
             LLCP_TRACE_DEBUG1 ("Peer WKS - 0x%04X", llcp_cb.lcb.peer_wks);
             break;
 
         case LLCP_LTO_TYPE:
-            BE_STREAM_TO_UINT8 (param_len, p);
+            if (param_len != LLCP_LTO_LEN) {
+                android_errorWriteLog(0x534e4554, "114238578");
+                LOG(ERROR) << StringPrintf("Bad TLV's");
+                return false;
+            }
             BE_STREAM_TO_UINT8 (llcp_cb.lcb.peer_lto, p);
             llcp_cb.lcb.peer_lto *= LLCP_LTO_UNIT;  /* 10ms unit */
             LLCP_TRACE_DEBUG1 ("Peer LTO - %d ms", llcp_cb.lcb.peer_lto);
             break;
 
         case LLCP_OPT_TYPE:
-            BE_STREAM_TO_UINT8 (param_len, p);
+            if (param_len != LLCP_OPT_LEN) {
+                android_errorWriteLog(0x534e4554, "114238578");
+                LOG(ERROR) << StringPrintf("Bad TLV's");
+                return false;
+            }
             BE_STREAM_TO_UINT8 (llcp_cb.lcb.peer_opt, p);
             LLCP_TRACE_DEBUG1 ("Peer OPT - 0x%02X", llcp_cb.lcb.peer_opt);
             break;
 
         default:
             LLCP_TRACE_ERROR1 ("llcp_util_parse_link_params (): Unexpected type 0x%x", param_type);
-            BE_STREAM_TO_UINT8 (param_len, p);
             p += param_len;
             break;
         }
-
-        if (length >= param_len + 1)
-            length -= param_len + 1;
-        else
-        {
-            LLCP_TRACE_ERROR0 ("llcp_util_parse_link_params (): Bad LTV's");
-            return (FALSE);
-        }
     }
     return (TRUE);
 }
@@ -498,15 +515,26 @@ tLLCP_STATUS llcp_util_parse_connect (UINT8  *p_bytes, UINT16 length, tLLCP_CONN
     p_params->sn[0] = 0;
     p_params->sn[1] = 0;
 
-    while (length)
+    while (length >= 2)
     {
-        BE_STREAM_TO_UINT8 (param_type, p);
-        length--;
+        BE_STREAM_TO_UINT8(param_type, p);
+        BE_STREAM_TO_UINT8(param_len, p);
+        /* check remaining lengh */
+        if (length < param_len + 2) {
+            android_errorWriteLog(0x534e4554, "111660010");
+            LOG(ERROR) << StringPrintf("Bad TLV's");
+            return LLCP_STATUS_FAIL;
+        }
+        length -= param_len + 2;
 
         switch (param_type)
         {
         case LLCP_MIUX_TYPE:
-            BE_STREAM_TO_UINT8 (param_len, p);
+            if (param_len != LLCP_MIUX_LEN) {
+                android_errorWriteLog(0x534e4554, "111660010");
+                LOG(ERROR) << StringPrintf("Bad TLV's");
+                return LLCP_STATUS_FAIL;
+            }
             BE_STREAM_TO_UINT16 (p_params->miu, p);
             p_params->miu &= LLCP_MIUX_MASK;
             p_params->miu += LLCP_DEFAULT_MIU;
@@ -515,7 +543,11 @@ tLLCP_STATUS llcp_util_parse_connect (UINT8  *p_bytes, UINT16 length, tLLCP_CONN
             break;
 
         case LLCP_RW_TYPE:
-            BE_STREAM_TO_UINT8 (param_len, p);
+            if (param_len != LLCP_RW_LEN) {
+                android_errorWriteLog(0x534e4554, "111660010");
+                LOG(ERROR) << StringPrintf("Bad TLV's");
+                return LLCP_STATUS_FAIL;
+            }
             BE_STREAM_TO_UINT8 (p_params->rw, p);
             p_params->rw &= 0x0F;
 
@@ -523,8 +555,6 @@ tLLCP_STATUS llcp_util_parse_connect (UINT8  *p_bytes, UINT16 length, tLLCP_CONN
             break;
 
         case LLCP_SN_TYPE:
-            BE_STREAM_TO_UINT8 (param_len, p);
-
             if (param_len == 0)
             {
                 /* indicate that SN type is included without SN */
@@ -547,21 +577,9 @@ tLLCP_STATUS llcp_util_parse_connect (UINT8  *p_bytes, UINT16 length, tLLCP_CONN
 
         default:
             LLCP_TRACE_ERROR1 ("llcp_util_parse_connect (): Unexpected type 0x%x", param_type);
-            BE_STREAM_TO_UINT8 (param_len, p);
             p += param_len;
             break;
         }
-
-        /* check remaining lengh */
-        if (length >= param_len + 1)
-        {
-            length -= param_len + 1;
-        }
-        else
-        {
-            LLCP_TRACE_ERROR0 ("llcp_util_parse_connect (): Bad LTV's");
-            return LLCP_STATUS_FAIL;
-        }
     }
     return LLCP_STATUS_SUCCESS;
 }
@@ -641,15 +659,25 @@ tLLCP_STATUS llcp_util_parse_cc (UINT8 *p_bytes, UINT16 length, UINT16 *p_miu, U
     *p_miu = LLCP_DEFAULT_MIU;
     *p_rw  = LLCP_DEFAULT_RW;
 
-    while (length)
+    while (length >= 2)
     {
         BE_STREAM_TO_UINT8 (param_type, p);
-        length--;
+        BE_STREAM_TO_UINT8(param_len, p);
+        if (length < param_len + 2) {
+            android_errorWriteLog(0x534e4554, "114237888");
+            LOG(ERROR) << StringPrintf("Bad TLV's");
+            return LLCP_STATUS_FAIL;
+        }
+        length -= param_len + 2;
 
         switch (param_type)
         {
         case LLCP_MIUX_TYPE:
-            BE_STREAM_TO_UINT8 (param_len, p);
+            if (param_len != LLCP_MIUX_LEN) {
+                android_errorWriteLog(0x534e4554, "114237888");
+                LOG(ERROR) << StringPrintf("Bad TLV's");
+                return LLCP_STATUS_FAIL;
+            }
             BE_STREAM_TO_UINT16 ((*p_miu), p);
             (*p_miu) &= LLCP_MIUX_MASK;
             (*p_miu) += LLCP_DEFAULT_MIU;
@@ -658,7 +686,11 @@ tLLCP_STATUS llcp_util_parse_cc (UINT8 *p_bytes, UINT16 length, UINT16 *p_miu, U
             break;
 
         case LLCP_RW_TYPE:
-            BE_STREAM_TO_UINT8 (param_len, p);
+            if (param_len != LLCP_RW_LEN) {
+               android_errorWriteLog(0x534e4554, "114237888");
+               LOG(ERROR) << StringPrintf("Bad TLV's");
+               return LLCP_STATUS_FAIL;
+            }
             BE_STREAM_TO_UINT8 ((*p_rw), p);
             (*p_rw) &= 0x0F;
 
@@ -667,18 +699,9 @@ tLLCP_STATUS llcp_util_parse_cc (UINT8 *p_bytes, UINT16 length, UINT16 *p_miu, U
 
         default:
             LLCP_TRACE_ERROR1 ("llcp_util_parse_cc (): Unexpected type 0x%x", param_type);
-            BE_STREAM_TO_UINT8 (param_len, p);
             p += param_len;
             break;
         }
-
-        if (length >= param_len + 1)
-            length -= param_len + 1;
-        else
-        {
-            LLCP_TRACE_ERROR0 ("llcp_util_parse_cc (): Bad LTV's");
-            return LLCP_STATUS_FAIL;
-        }
     }
     return LLCP_STATUS_SUCCESS;
 }
diff --git a/src/nfc/nfc/nfc_ncif.c b/src/nfc/nfc/nfc_ncif.c
index 2e2c14f..739bae2 100644
--- a/src/nfc/nfc/nfc_ncif.c
+++ b/src/nfc/nfc/nfc_ncif.c
@@ -26,6 +26,7 @@
  ******************************************************************************/
 #include <stdlib.h>
 #include <string.h>
+#include <log/log.h>
 #include "nfc_target.h"
 
 #if NFC_INCLUDED == TRUE
@@ -490,14 +491,31 @@ void nfc_ncif_set_config_status (UINT8 *p, UINT8 len)
     tNFC_RESPONSE   evt_data;
     if (nfc_cb.p_resp_cback)
     {
-        evt_data.set_config.status          = (tNFC_STATUS) *p++;
-        evt_data.set_config.num_param_id    = NFC_STATUS_OK;
-        if (evt_data.set_config.status != NFC_STATUS_OK)
-        {
-            evt_data.set_config.num_param_id    = *p++;
-            STREAM_TO_ARRAY (evt_data.set_config.param_ids, p, evt_data.set_config.num_param_id);
+        evt_data.set_config.num_param_id = 0;
+        if (len == 0) {
+            LOG(ERROR) << StringPrintf("Insufficient RSP length");
+            evt_data.set_config.status = NFC_STATUS_SYNTAX_ERROR;
+            (*nfc_cb.p_resp_cback)(NFC_SET_CONFIG_REVT, &evt_data);
+            return;
         }
 
+        evt_data.set_config.status = (tNFC_STATUS)*p++;
+        if (evt_data.set_config.status != NFC_STATUS_OK && len > 1) {
+            evt_data.set_config.num_param_id = *p++;
+            if (evt_data.set_config.num_param_id > NFC_MAX_NUM_IDS) {
+                android_errorWriteLog(0x534e4554, "114047681");
+                LOG(ERROR) << StringPrintf("OOB write num_param_id %d",
+                                       evt_data.set_config.num_param_id);
+                evt_data.set_config.num_param_id = 0;
+            } else if (evt_data.set_config.num_param_id <= len - 2) {
+                STREAM_TO_ARRAY(evt_data.set_config.param_ids, p,
+                        evt_data.set_config.num_param_id);
+            } else {
+                LOG(ERROR) << StringPrintf("Insufficient RSP length %d,num_param_id %d",
+                                       len, evt_data.set_config.num_param_id);
+                evt_data.set_config.num_param_id = 0;
+            }
+	}
         (*nfc_cb.p_resp_cback) (NFC_SET_CONFIG_REVT, &evt_data);
     }
 }
@@ -1171,8 +1189,13 @@ void nfc_ncif_proc_get_routing (UINT8 *p, UINT8 len)
             {
                 tl                  = *(p+1);
                 tl                 += NFC_TL_SIZE;
-                STREAM_TO_ARRAY (pn, p, tl);
                 evt_data.tlv_size  += tl;
+		if (evt_data.tlv_size > NFC_MAX_EE_TLV_SIZE) {
+                    android_errorWriteLog(0x534e4554, "117554809");
+                    LOG(ERROR) << __func__ << "Invalid data format";
+                    return;
+                }
+                STREAM_TO_ARRAY(pn, p, tl);
                 pn                 += tl;
             }
             (*nfc_cb.p_resp_cback) (NFC_GET_ROUTING_REVT, (tNFC_RESPONSE *) &evt_data);
diff --git a/src/nfc/tags/ce_t4t.c b/src/nfc/tags/ce_t4t.c
index b812cff..84e55db 100644
--- a/src/nfc/tags/ce_t4t.c
+++ b/src/nfc/tags/ce_t4t.c
@@ -23,6 +23,7 @@
  *  mode.
  *
  ******************************************************************************/
+#include <log/log.h>
 #include <string.h>
 #include "nfc_target.h"
 #include "bt_types.h"
@@ -431,6 +432,14 @@ static void ce_t4t_process_select_app_cmd (UINT8 *p_cmd, BT_HDR *p_c_apdu)
     /* Lc Byte */
     BE_STREAM_TO_UINT8 (data_len, p_cmd);
 
+    /*CLS+INS+P1+P2+Lc+Data*/
+    if (data_len > (p_c_apdu->len - T4T_CMD_MAX_HDR_SIZE)) {
+        LOG(ERROR) << StringPrintf("Wrong length in ce_t4t_process_select_app_cmd");
+        android_errorWriteLog(0x534e4554, "115635871");
+        ce_t4t_send_status(T4T_RSP_WRONG_LENGTH);
+        GKI_freebuf(p_c_apdu);
+        return;
+    }
 #if (CE_TEST_INCLUDED == TRUE)
     if (mapping_aid_test_enabled)
     {
@@ -600,6 +609,7 @@ static void ce_t4t_data_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_
     BT_HDR  *p_c_apdu;
     UINT8   *p_cmd;
     UINT8    cla, instruct, select_type = 0, length;
+    UINT8    cla = 0, instruct = 0, select_type = 0, length = 0;
     UINT16   offset, max_file_size;
     tCE_DATA ce_data;
 
@@ -622,6 +632,13 @@ static void ce_t4t_data_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_
     CE_TRACE_DEBUG1 ("ce_t4t_data_cback (): conn_id = 0x%02X", conn_id);
 
     p_cmd = (UINT8 *) (p_c_apdu + 1) + p_c_apdu->offset;
+    if (p_c_apdu->len == 0) {
+        LOG(ERROR) << StringPrintf("Wrong length in ce_t4t_data_cback");
+        android_errorWriteLog(0x534e4554, "115635871");
+        ce_t4t_send_status(T4T_RSP_WRONG_LENGTH);
+        if (p_c_apdu) GKI_freebuf(p_c_apdu);
+            return;
+    }
 
     /* Class Byte */
     BE_STREAM_TO_UINT8 (cla, p_cmd);
@@ -636,18 +653,26 @@ static void ce_t4t_data_cback (UINT8 conn_id, tNFC_CONN_EVT event, tNFC_CONN *p_
         return;
     }
 
-    /* Instruction Byte */
-    BE_STREAM_TO_UINT8 (instruct, p_cmd);
-
-    if ((cla == T4T_CMD_CLASS) && (instruct == T4T_CMD_INS_SELECT))
-    {
-        /* P1 Byte */
-        BE_STREAM_TO_UINT8 (select_type, p_cmd);
-
-        if (select_type == T4T_CMD_P1_SELECT_BY_NAME)
-        {
-            ce_t4t_process_select_app_cmd (p_cmd, p_c_apdu);
-            return;
+    /*CLA+INS+P1+P2 = 4 bytes*/
+    if (p_c_apdu->len >= T4T_CMD_MIN_HDR_SIZE) {
+        /* Instruction Byte */
+        BE_STREAM_TO_UINT8(instruct, p_cmd);
+        if ((cla == T4T_CMD_CLASS) && (instruct == T4T_CMD_INS_SELECT)) {
+            /* P1 Byte */
+            BE_STREAM_TO_UINT8(select_type, p_cmd);
+            if (select_type == T4T_CMD_P1_SELECT_BY_NAME) {
+                /*CLA+INS+P1+P2+Lc = 5 bytes*/
+                if (p_c_apdu->len >= T4T_CMD_MAX_HDR_SIZE) {
+                    ce_t4t_process_select_app_cmd(p_cmd, p_c_apdu);
+                    return;
+                } else {
+                    LOG(ERROR) << StringPrintf("Wrong length in select app cmd");
+                    android_errorWriteLog(0x534e4554, "115635871");
+                    ce_t4t_send_status(T4T_RSP_NOT_FOUND);
+                    if (p_c_apdu) GKI_freebuf(p_c_apdu);
+                        return;
+                }
+            }
         }
     }
 
diff --git a/src/nfc/tags/rw_i93.c b/src/nfc/tags/rw_i93.c
index cec6af9..61dd913 100644
--- a/src/nfc/tags/rw_i93.c
+++ b/src/nfc/tags/rw_i93.c
@@ -23,6 +23,7 @@
  *  mode.
  *
  ******************************************************************************/
+#include <log/log.h>
 #include <string.h>
 #include "nfc_target.h"
 #include "bt_types.h"
@@ -203,7 +204,7 @@ void rw_i93_get_product_version (UINT8 *p_uid)
 ** Returns          FALSE if retrying with protocol extension flag
 **
 *******************************************************************************/
-BOOLEAN rw_i93_process_sys_info (UINT8* p_data)
+BOOLEAN rw_i93_process_sys_info (UINT8* p_data, UINT16 length)
 {
     UINT8      *p     = p_data;
     tRW_I93_CB *p_i93 = &rw_cb.tcb.i93;
@@ -211,38 +212,62 @@ BOOLEAN rw_i93_process_sys_info (UINT8* p_data)
 
     RW_TRACE_DEBUG0 ("rw_i93_process_sys_info ()");
 
+    if (length < (I93_UID_BYTE_LEN + 1)) {
+        android_errorWriteLog(0x534e4554, "121259048");
+        return false;
+    }
     STREAM_TO_UINT8 (p_i93->info_flags, p);
+    length--;
 
     p_uid = uid;
     STREAM_TO_ARRAY8 (p_uid, p);
+    length -= I93_UID_BYTE_LEN;
 
     if (p_i93->info_flags & I93_INFO_FLAG_DSFID)
     {
+        if (length == 0) {
+            android_errorWriteLog(0x534e4554, "121259048");
+            return false;
+        }
         STREAM_TO_UINT8 (p_i93->dsfid, p);
+	length--;
     }
     if (p_i93->info_flags & I93_INFO_FLAG_AFI)
     {
+        if (length == 0) {
+            android_errorWriteLog(0x534e4554, "121259048");
+            return false;
+        }
         STREAM_TO_UINT8 (p_i93->afi, p);
+	length--;
     }
     if (p_i93->info_flags & I93_INFO_FLAG_MEM_SIZE)
     {
-        if (p_i93->intl_flags & RW_I93_FLAG_16BIT_NUM_BLOCK)
-        {
+        bool block_16_bit = p_i93->intl_flags & RW_I93_FLAG_16BIT_NUM_BLOCK;
+        if (block_16_bit && length > 2) {
             STREAM_TO_UINT16 (p_i93->num_block, p);
-        }
-        else
-        {
+            length -= 2;
+        } else if (!block_16_bit && length > 1) {
             STREAM_TO_UINT8 (p_i93->num_block, p);
+            length--;
+        } else {
+           android_errorWriteLog(0x534e4554, "121259048");
+           return false;
         }
         /* it is one less than actual number of bytes */
         p_i93->num_block += 1;
 
         STREAM_TO_UINT8 (p_i93->block_size, p);
+	length--;
         /* it is one less than actual number of blocks */
         p_i93->block_size = (p_i93->block_size & 0x1F) + 1;
     }
     if (p_i93->info_flags & I93_INFO_FLAG_IC_REF)
     {
+        if (length == 0) {
+            android_errorWriteLog(0x534e4554, "121259048");
+            return false;
+        }
         STREAM_TO_UINT8 (p_i93->ic_reference, p);
 
         /* clear existing UID to set product version */
@@ -447,7 +472,7 @@ void rw_i93_send_to_upper (BT_HDR *p_resp)
 
     case I93_CMD_GET_SYS_INFO:
 
-        if (rw_i93_process_sys_info (p))
+        if (rw_i93_process_sys_info (p, length))
         {
             rw_data.i93_sys_info.status     = NFC_STATUS_OK;
             rw_data.i93_sys_info.info_flags = p_i93->info_flags;
@@ -1506,6 +1531,11 @@ void rw_i93_sm_detect_ndef (BT_HDR *p_resp)
     RW_TRACE_DEBUG1 ("rw_i93_sm_detect_ndef () sub_state:0x%x", p_i93->sub_state);
 #endif
 
+    if (length == 0) {
+        android_errorWriteLog(0x534e4554, "121260197");
+        rw_i93_handle_error(NFC_STATUS_FAILED);
+        return;
+    }
     STREAM_TO_UINT8 (flags, p);
     length--;
 
@@ -1529,6 +1559,11 @@ void rw_i93_sm_detect_ndef (BT_HDR *p_resp)
     {
     case RW_I93_SUBSTATE_WAIT_UID:
 
+        if (length < (I93_UID_BYTE_LEN + 1)) {
+            android_errorWriteLog(0x534e4554, "121260197");
+            rw_i93_handle_error(NFC_STATUS_FAILED);
+            return;
+        }
         STREAM_TO_UINT8 (u8, p); /* DSFID */
         p_uid = p_i93->uid;
         STREAM_TO_ARRAY8 (p_uid, p);
@@ -1558,7 +1593,7 @@ void rw_i93_sm_detect_ndef (BT_HDR *p_resp)
         p_i93->block_size = 0;
         p_i93->num_block  = 0;
 
-        if (!rw_i93_process_sys_info (p))
+        if (!rw_i93_process_sys_info (p, length))
         {
             /* retrying with protocol extension flag */
             break;
@@ -1952,6 +1987,12 @@ void rw_i93_sm_read_ndef (BT_HDR *p_resp)
 
     RW_TRACE_DEBUG0 ("rw_i93_sm_read_ndef ()");
 
+    if (length == 0) {
+        android_errorWriteLog(0x534e4554, "122035770");
+        rw_i93_handle_error(NFC_STATUS_FAILED);
+        return;
+    }
+
     STREAM_TO_UINT8 (flags, p);
     length--;
 
@@ -2067,6 +2108,12 @@ void rw_i93_sm_update_ndef (BT_HDR *p_resp)
     RW_TRACE_DEBUG1 ("rw_i93_sm_update_ndef () sub_state:0x%x", p_i93->sub_state);
 #endif
 
+    if (length == 0 || p_i93->block_size > I93_MAX_BLOCK_LENGH) {
+        android_errorWriteLog(0x534e4554, "122320256");
+        rw_i93_handle_error(NFC_STATUS_FAILED);
+        return;
+    }
+
     STREAM_TO_UINT8 (flags, p);
     length--;
 
@@ -2096,6 +2143,12 @@ void rw_i93_sm_update_ndef (BT_HDR *p_resp)
         /* get offset of length field */
         length_offset = (p_i93->ndef_tlv_start_offset + 1) % p_i93->block_size;
 
+        if (length < length_offset) {
+            android_errorWriteLog(0x534e4554, "122320256");
+            rw_i93_handle_error(NFC_STATUS_FAILED);
+            return;
+        }
+ 
         /* set length to zero */
         *(p + length_offset) = 0x00;
 
@@ -2114,6 +2167,11 @@ void rw_i93_sm_update_ndef (BT_HDR *p_resp)
             /* write the first part of NDEF in the same block */
             for ( ; xx < p_i93->block_size; xx++)
             {
+                if (xx > length || p_i93->rw_length > p_i93->ndef_length) {
+                    android_errorWriteLog(0x534e4554, "122320256");
+                    rw_i93_handle_error(NFC_STATUS_FAILED);
+                    return;
+                }
                 if (p_i93->rw_length < p_i93->ndef_length)
                 {
                     *(p + xx) = *(p_i93->p_update_data + p_i93->rw_length++);
@@ -2289,6 +2347,12 @@ void rw_i93_sm_update_ndef (BT_HDR *p_resp)
                 /* update length field within the read block */
                 for (xx = length_offset; xx < p_i93->block_size; xx++)
                 {
+                    if (xx > length) {
+                        android_errorWriteLog(0x534e4554, "122320256");
+                        rw_i93_handle_error(NFC_STATUS_FAILED);
+                        return;
+                    }
+
                     if (p_i93->rw_length == 3)
                         *(p + xx) = 0xFF;
                     else if (p_i93->rw_length == 2)
@@ -2418,7 +2482,7 @@ void rw_i93_sm_format (BT_HDR *p_resp)
         p_i93->block_size = 0;
         p_i93->num_block  = 0;
 
-        if (!rw_i93_process_sys_info (p))
+        if (!rw_i93_process_sys_info (p, length))
         {
             /* retrying with protocol extension flag */
             break;
diff --git a/src/nfc/tags/rw_t2t_ndef.c b/src/nfc/tags/rw_t2t_ndef.c
index 3304a90..37dd8e4 100644
--- a/src/nfc/tags/rw_t2t_ndef.c
+++ b/src/nfc/tags/rw_t2t_ndef.c
@@ -23,6 +23,7 @@
  *  Reader/Writer mode.
  *
  ******************************************************************************/
+#include <log/log.h>
 #include <string.h>
 #include "nfc_target.h"
 
@@ -646,7 +647,12 @@ static void rw_t2t_handle_tlv_detect_rsp (UINT8 *p_data)
                 break;
 
             case TAG_LOCK_CTRL_TLV:
-                p_t2t->bytes_count--;
+                if (p_t2t->bytes_count > 0) {
+                    p_t2t->bytes_count--;
+                } else {
+                    LOG(ERROR) << StringPrintf("Underflow p_t2t->bytes_count!");
+                    android_errorWriteLog(0x534e4554, "120506143");
+                }
                 if (  (tlvtype == TAG_LOCK_CTRL_TLV)
                     ||(tlvtype == TAG_NDEF_TLV)  )
                 {
@@ -664,6 +670,10 @@ static void rw_t2t_handle_tlv_detect_rsp (UINT8 *p_data)
 
                         /* Extract lockbytes info addressed by this Lock TLV */
                         xx = 0;
+			if (count > RW_T2T_MAX_LOCK_BYTES) {
+                            count = RW_T2T_MAX_LOCK_BYTES;
+                            android_errorWriteLog(0x534e4554, "112161557");
+                        }
                         while (xx < count)
                         {
                             p_t2t->lockbyte[p_t2t->num_lockbytes].tlv_index     = p_t2t->num_lock_tlvs;
@@ -689,7 +699,12 @@ static void rw_t2t_handle_tlv_detect_rsp (UINT8 *p_data)
                 break;
 
             case TAG_MEM_CTRL_TLV:
-                p_t2t->bytes_count--;
+                if (p_t2t->bytes_count > 0) {
+                    p_t2t->bytes_count--;
+                } else {
+                    LOG(ERROR) << StringPrintf("bytes_count underflow!");
+                    android_errorWriteLog(0x534e4554, "120506143");
+                }
                 if (  (tlvtype == TAG_MEM_CTRL_TLV)
                     ||(tlvtype == TAG_NDEF_TLV)  )
                 {
@@ -724,7 +739,12 @@ static void rw_t2t_handle_tlv_detect_rsp (UINT8 *p_data)
                 break;
 
             case TAG_PROPRIETARY_TLV:
-                p_t2t->bytes_count--;
+                if (p_t2t->bytes_count > 0) {
+                    p_t2t->bytes_count--;
+                } else {
+                    LOG(ERROR) << StringPrintf("bytes_count underflow!");
+                    android_errorWriteLog(0x534e4554, "120506143");
+                }
                 if (tlvtype == TAG_PROPRIETARY_TLV)
                 {
                     found = TRUE;
diff --git a/src/nfc/tags/rw_t3t.c b/src/nfc/tags/rw_t3t.c
index f8ec361..45a74dd 100644
--- a/src/nfc/tags/rw_t3t.c
+++ b/src/nfc/tags/rw_t3t.c
@@ -1285,6 +1285,10 @@ void rw_t3t_act_handle_ndef_detect_rsp (tRW_T3T_CB *p_cb, BT_HDR *p_msg_rsp)
              ||(memcmp (p_cb->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM], NCI_NFCID2_LEN) != 0)  )   /* verify response IDm */
     {
         evt_data.status = NFC_STATUS_FAILED;
+    } else if (p_msg_rsp->len <
+               (T3T_MSG_RSP_OFFSET_CHECK_DATA + T3T_MSG_BLOCKSIZE)) {
+        evt_data.status = NFC_STATUS_FAILED;
+        android_errorWriteLog(0x534e4554, "120428041");
     }
     else
     {
@@ -1399,7 +1403,7 @@ void rw_t3t_act_handle_check_rsp (tRW_T3T_CB *p_cb, BT_HDR *p_msg_rsp)
         nfc_status = NFC_STATUS_FAILED;
         GKI_freebuf (p_msg_rsp);
     }
-    else
+    else if (p_msg_rsp->len >= T3T_MSG_RSP_OFFSET_CHECK_DATA) {
     {
         /* Copy incoming data into buffer */
         p_msg_rsp->offset += T3T_MSG_RSP_OFFSET_CHECK_DATA;     /* Skip over t3t header */
@@ -1407,6 +1411,10 @@ void rw_t3t_act_handle_check_rsp (tRW_T3T_CB *p_cb, BT_HDR *p_msg_rsp)
         evt_data.status = NFC_STATUS_OK;
         evt_data.p_data = p_msg_rsp;
         (*(rw_cb.p_cback)) (RW_T3T_CHECK_EVT, (tRW_DATA *) &evt_data);
+    } else {
+        android_errorWriteLog(0x534e4554, "120503926");
+        nfc_status = NFC_STATUS_FAILED;
+        GKI_freebuf(p_msg_rsp);
     }
 
 
@@ -1514,11 +1522,11 @@ void rw_t3t_act_handle_check_ndef_rsp (tRW_T3T_CB *p_cb, BT_HDR *p_msg_rsp)
         RW_TRACE_ERROR2 ("Response error: expecting rsp_code %02X, but got %02X", T3T_MSG_OPC_CHECK_RSP, p_t3t_rsp[T3T_MSG_RSP_OFFSET_RSPCODE]);
         nfc_status = NFC_STATUS_FAILED;
         GKI_freebuf (p_msg_rsp);
-    }
-    else
-    {
+    } else if (p_msg_rsp->len >= T3T_MSG_RSP_OFFSET_CHECK_DATA &&
+               p_t3t_rsp[T3T_MSG_RSP_OFFSET_NUMBLOCKS] > 0) {
         /* Notify app of NDEF segment received */
-        rsp_num_bytes_rx = p_t3t_rsp[T3T_MSG_RSP_OFFSET_NUMBLOCKS] * 16;    /* Number of bytes received, according to header */
+        /* Number of bytes received, according to header */
+        rsp_num_bytes_rx = p_t3t_rsp[T3T_MSG_RSP_OFFSET_NUMBLOCKS] * 16;
         p_cb->ndef_rx_offset += p_cb->ndef_rx_readlen;
         read_data.status = NFC_STATUS_OK;
         p_msg_rsp->offset += T3T_MSG_RSP_OFFSET_CHECK_DATA;     /* Skip over t3t header (point to block data) */
@@ -1553,6 +1561,11 @@ void rw_t3t_act_handle_check_ndef_rsp (tRW_T3T_CB *p_cb, BT_HDR *p_msg_rsp)
                 }
             }
         }
+    } else {
+       android_errorWriteLog(0x534e4554, "120502559");
+       GKI_freebuf(p_msg_rsp);
+       nfc_status = NFC_STATUS_FAILED;
+       RW_TRACE_ERROR0("Underflow in p_msg_rsp->len!");
     }
 
     /* Notify app of RW_T3T_CHECK_CPLT_EVT if entire NDEF has been read, or if failure */
@@ -1667,8 +1680,12 @@ static void rw_t3t_handle_get_sc_poll_rsp (tRW_T3T_CB *p_cb, UINT8 nci_status, U
             {
                 RW_TRACE_DEBUG1 ("FeliCa Lite tag detected (system code %04X)", sc);
                 /* Store system code */
-                p_cb->system_codes[p_cb->num_system_codes++] = sc;
-
+                if (p_cb->num_system_codes < T3T_MAX_SYSTEM_CODES) {
+                    p_cb->system_codes[p_cb->num_system_codes++] = sc;
+                } else {
+                    LOG(ERROR) << StringPrintf("Exceed T3T_MAX_SYSTEM_CODES!");
+                    android_errorWriteLog(0x534e4554, "120499324");
+                }
                 /* Poll for NDEF system code */
                 if ((status = (tNFC_STATUS) nci_snd_t3t_polling (T3T_SYSTEM_CODE_NDEF, 0, 0)) == NCI_STATUS_OK)
                 {
@@ -1956,6 +1973,10 @@ void rw_t3t_act_handle_fmt_rsp (tRW_T3T_CB *p_cb, BT_HDR *p_msg_rsp)
                  ||(memcmp (p_cb->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM], NCI_NFCID2_LEN) != 0)  )   /* verify response IDm */
         {
             evt_data.status = NFC_STATUS_FAILED;
+	} else if (p_msg_rsp->len <
+                   (T3T_MSG_RSP_OFFSET_CHECK_DATA + T3T_MSG_BLOCKSIZE)) {
+            evt_data.status = NFC_STATUS_FAILED;
+            android_errorWriteLog(0x534e4554, "120506143");
         }
         else
         {
@@ -2168,19 +2189,17 @@ void rw_t3t_act_handle_sro_rsp (tRW_T3T_CB *p_cb, BT_HDR *p_msg_rsp)
                  ||(memcmp (p_cb->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM], NCI_NFCID2_LEN) != 0)  )   /* verify response IDm */
         {
             evt_data.status = NFC_STATUS_FAILED;
+	} else if (p_msg_rsp->len <
+                   (T3T_MSG_RSP_OFFSET_CHECK_DATA + T3T_MSG_BLOCKSIZE)) {
+            evt_data.status = NFC_STATUS_FAILED;
+            android_errorWriteLog(0x534e4554, "120506143");
         }
         else
         {
             /* Check if memory configuration (MC) block to see if SYS_OP=1 (NDEF enabled) */
             p_mc = &p_t3t_rsp[T3T_MSG_RSP_OFFSET_CHECK_DATA];  /* Point to MC data of CHECK response */
-
-            if (p_mc[T3T_MSG_FELICALITE_MC_OFFSET_SYS_OP] != 0x01)
-            {
-                /* Tag is not currently enabled for NDEF */
-                evt_data.status = NFC_STATUS_FAILED;
-            }
-            else
-            {
+            evt_data.status = NFC_STATUS_FAILED;
+            if (p_mc[T3T_MSG_FELICALITE_MC_OFFSET_SYS_OP] == 0x01) {
                 /* Set MC_SP field with MC[0] = 0x00 & MC[1] = 0xC0 (Hardlock) to change access permission from RW to RO */
                 p_mc[T3T_MSG_FELICALITE_MC_OFFSET_MC_SP]     = 0x00;
                 /* Not changing the access permission of Subtraction Register and MC[0:1] */