Android NFC Service Denial of Service

------------------------------------------------------------------
I. Summary

NFC Service is a process of Android OS for providing access to NFC functionality, allowing 

applications to read NDEF message in NFC tags. A flaw has beend found in NFC Service implementation in 

Android OS before 4.4. When a bluetooth pair tag written with a crafted message is touched by a phone 

with Android OS before 4.4, it will cause a denial of service of NFC service.

------------------------------------------------------------------
II. Description

According to the NFC Bluetooth Simple Pairing Message Specification(NFC Forum), construct a message 

with its field "Length of Local Name" set to 0b0000 0000 or 0b1XXX XXXX(X means any binary value). 

Then write the crafted messages to NFC tag. Touch the NFC tag with a smart phone with Android OS 

before 4.4, NFC Service will crash. The reason for this is that NFC Stack don't parse zero length or 

negative length correctly (com.android.nfc.handover.HandoverManager.parseBtOob/
com.android.nfc.handover.HandoverManager.parse). Here are two crafted messages.
Eg.1 zero value
DA 20 1C 01 61 70 70 6C 69 63 61 74 69 6F 6E 2F
76 6E 64 2E 62 6C 75 65 74 6F 6F 74 68 2E 65 70
2E 6F 6F 62 30 1C 00 5C 5C 5C 5C 5C 5C [00] 09 41
6E 64 72 6F 69 64 04 0D 0C 02 40 05 03 1E 11 0B 11
Eg.2 negative value
DA 20 1C 01 61 70 70 6C 69 63 61 74 69 6F 6E 2F 
76 6E 64 2E 62 6C 75 65 74 6F 6F 74 68 2E 65 70 
2E 6F 6F 62 30 1C 00 5C 5C 5C 5C 5C 5C [80] 09 41 
6E 64 72 6F 69 64 04 0D 0C 02 40 05 03 1E 11 0B 11

------------------------------------------------------------------
III. Impact

This bug cause a DoS of NFC service and NFC function returns to normal until NFC Service reboot 

automatically .

------------------------------------------------------------------
IV. Affected

Android OS before 4.4. Other customized OS based on Android may also be affected due to this bug, such 

as MIUI before 5.30.

------------------------------------------------------------------
V. Solution

modify the source codes about Bluetooth pairing message parsing.