CVE-2026-55286 AI-generated analysis
platform/hardware/st/nfc, libstpropnci (ST NFC HAL proprietary NCI processing library, INfc::write() path)
Adds an early length check in stpropnci_process() (ST NFC HAL, libstpropnci) that drops and logs any NCI message whose payloadlen exceeds MAX_NCI_MESSAGE_LEN.
Root cause
Per the commit message, the ST NFC HAL's INfc::write() implementation did not check the length of incoming payloads. A payload longer than MAX_NCI_MESSAGE_LEN therefore reached an unbounded memcpy into a fixed-size buffer and wrote out of bounds over global state variables. stpropnci_process() had no check of payloadlen against MAX_NCI_MESSAGE_LEN. The material does not show the exact memcpy site or which buffer is the destination.
How the fix works
- libstpropnci/src/stpropnci.cc:stpropnci_process(): the new check `if (payloadlen > MAX_NCI_MESSAGE_LEN)` sits after the existing early-return block, while reentry_lock is still held. It logs via LOG_E ("Dropping oversized NCI message: %d > %d"), unlocks reentry_lock and returns ret. The oversized message is never processed further.
- The check comes before the `if (!stpropnci_state.passthrough_mode)` branch and does not depend on dir_from_upper. It therefore applies in both passthrough modes and to both message directions handled by stpropnci_process().
Completeness
- Covers: every message that gets past the earlier early-return block in stpropnci_process() is now bounded by MAX_NCI_MESSAGE_LEN, whatever the passthrough mode or direction.
- Leaves out: the fix rejects only payloads that are too long overall. It does not check minimum lengths or per-field lengths. Per index search, downstream handlers such as stpropnci_process_uid_and_sak_steps index payload[3] and payload[6] and size a copy from payload[6] with no visible reference to payloadlen (see potential_variants).
Behavior changes
- NCI messages longer than MAX_NCI_MESSAGE_LEN are now dropped by the library (it returns ret without processing them) and an error line is logged. Previously they were processed.
Per major
- Android 14: not affected per the bulletin; code absent (libstpropnci/src/stpropnci.cc not present at android-security-14.0.0_r30)
- Android 15: not affected per the bulletin; code absent (libstpropnci/src/stpropnci.cc not present at android-security-15.0.0_r18)
- Android 16: not affected per the bulletin; code absent (libstpropnci/src/stpropnci.cc not present at android-security-16.0.0_r9)
- Android 17: same fix: commit bbb2d21c4d50 (cherry-pick of 867b2f4b7d87) in android-security-17.0.0_r1; all 4 checked lines of the patched region present at android-security-17.0.0_r2
Unknowns
- The exact memcpy site and its destination buffer are not shown. It may be stpropnci_state.tmpbuff / pumpstate.msgPool.payload, which stpropnci_init sets up, but the material does not confirm this. The destination buffer's size is not shown either.
- The value of ret at the new return point and the condition of the preceding early-return block are not shown.
- Whether stpropnci_init() must have run for the vulnerable path to be reached is not shown.
- How INfc::write() calls stpropnci_process(), whether the HAL does any length validation itself, and whether all handler paths (std/prop/prop_st/prop_android) are reached through stpropnci_process() is not shown.