Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a121cf33 authored by Pengquan Meng's avatar Pengquan Meng Committed by WolfEnders
Browse files

Fixed invalid pdu issue 

The device may receive invalid sms pdu, i.e the pdu contins sms header
with an invalid seqNumber. This caused InboundSmsHandler crashed constantly.
This CL added the range check for the seqNumber to ensure the
InboundSmsHandler will not crash even if the seqNumber is invalid.

Test: runtest -x GsmInboundSmsHandlerTest -m
testMultiPartSmsWithInvalidSeqNumber
Bug: 72298611

Merged-In: Icf291c8530abdc2a528c5cf227cf00135281b899
Change-Id: Icf291c8530abdc2a528c5cf227cf00135281b899
(cherry picked from commit 9eec9d02)
(cherry picked from commit d2f410c0)
(cherry picked from commit e8955271)
parent 8cc29fd5

src/java/com/android/internal/telephony/InboundSmsHandler.java

+29 −0
Original line number Diff line number Diff line
@@ -57,6 +57,7 @@ import java.util.Arrays; 
import java.util.Collections;

import java.util.List;

import java.util.Map;

import android.util.EventLog;



import static android.telephony.TelephonyManager.PHONE_TYPE_CDMA;
@@ -660,6 +661,19 @@ public abstract class InboundSmsHandler extends StateMachine { 
        byte[][] pdus;

        int destPort = tracker.getDestPort();



        // Do not process when the message count is invalid.

        if (messageCount <= 0) {

            EventLog.writeEvent(

                    0x534e4554 /* snetTagId */,

                    "72298611" /* buganizer id */,

                    -1 /* uid */,

                    String.format(

                            "processMessagePart: invalid messageCount = %d",

                            messageCount));



            return false;

        }



        if (messageCount == 1) {

            // single-part message

            pdus = new byte[][]{tracker.getPdu()};
@@ -693,6 +707,21 @@ public abstract class InboundSmsHandler extends StateMachine { 
                    // subtract offset to convert sequence to 0-based array index

                    int index = cursor.getInt(SEQUENCE_COLUMN) - tracker.getIndexOffset();



                    // The invalid PDUs can be received and stored in the raw table. The range

                    // check ensures the process not crash even if the seqNumber in the

                    // UserDataHeader is invalid.

                    if (index >= pdus.length || index < 0) {

                        EventLog.writeEvent(

                                0x534e4554 /* snetTagId */,

                                "72298611" /* buganizer id */,

                                -1 /* uid */,

                                String.format(

                                        "processMessagePart: invalid seqNumber = %d, messageCount = %d",

                                        index + tracker.getIndexOffset(),

                                        messageCount));

                        continue;

                    }



                    pdus[index] = HexDump.hexStringToByteArray(cursor.getString(PDU_COLUMN));



                    // Read the destination port from the first segment (needed for CDMA WAP PDU).