Commit f34f2355 authored Aug 12, 2014 by Nalla Kartheek Committed by Steve Kondik Sep 02, 2014

WiFi: Check data length before extracting

GBK to UTF convertion is carried on input data. The maximum data
that can be supported in framework is BUF_SIZE.
The gerrit is to check the size of input data  prior to parsing,
so that it will not lead to any crashes.

Change-Id: If8ff372dc26317b369643405dcea01ff28c4f1f3
CRs-Fixed: 708416

parent 5257ebe2

core/jni/android_net_wifi_Gbk2Utf.cpp

+4 −1

Original line number	Diff line number	Diff line
		@@ -470,7 +470,10 @@ jboolean setNetworkVariable(char *buf)
		char value[BUF_SIZE] = {0};
		char interface[BUF_SIZE] = {0};
		char dummy[BUF_SIZE] = {0};

		if (strlen(buf) > BUF_SIZE) {
		ALOGE("setNetworkVariable failed due to invalid length");
		return JNI_FALSE;
		}
		/* parse SET_NETWORK command*/
		sscanf(buf, "%s %s %d %s \"%s\"", interface, dummy, &netId, name, value);