mms: Safer fix for invalid content-disposition length (1d60a64f) · Commits · e / os / android_frameworks_base

core/java/com/google/android/mms/pdu/PduParser.java

+26 −8

Original line number	Diff line number	Diff line
		@@ -1555,12 +1555,25 @@ public class PduParser {
		* Attachment = <Octet 129>
		* Inline = <Octet 130>
		*/
		int len = parseValueLength(pduDataStream);
		int len = -1;
		boolean validDispositionLength = true;
		pduDataStream.mark(1);

		try {
		len = parseValueLength(pduDataStream);
		} catch (RuntimeException e) {
		// tolerate invalid content-disposition length
		len = 31;
		validDispositionLength = false;
		pduDataStream.reset();
		}

		pduDataStream.mark(1);
		int thisStartPos = pduDataStream.available();
		int thisEndPos = 0;
		int value = pduDataStream.read();

		if (validDispositionLength) {
		if (value == PduPart.P_DISPOSITION_FROM_DATA ) {
		part.setContentDisposition(PduPart.DISPOSITION_FROM_DATA);
		} else if (value == PduPart.P_DISPOSITION_ATTACHMENT) {
		@@ -1572,6 +1585,11 @@ public class PduParser {
		/* Token-text */
		part.setContentDisposition(parseWapString(pduDataStream, TYPE_TEXT_STRING));
		}
		} else {
		pduDataStream.reset();
		/* Token-text */
		part.setContentDisposition(parseWapString(pduDataStream, TYPE_TEXT_STRING));
		}

		/* get filename parameter and skip other parameters */
		thisEndPos = pduDataStream.available();