Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e68f7ec8 authored by Jack Yu's avatar Jack Yu
Browse files

Fixed that the device crashes when users send SMS via STK. 

If the user sends an SMS through STK menu, and the SMS encoding
is 7-bit GSM, the device will crash because of buffer overflow.
Fixed by supplying the correct buffer length while doing the
array copy.

bug: 23501570
Change-Id: I569b519a87ae693b0c35371ee160ca52fd5b6e6a
parent 9d19dccf

src/java/com/android/internal/telephony/cat/ResponseData.java

+19 −8
Original line number Diff line number Diff line
@@ -117,15 +117,14 @@ class GetInkeyInputResponseData extends ResponseData { 
                    // ucs2 is by definition big endian.

                    data = mInData.getBytes("UTF-16BE");

                } else if (mIsPacked) {

                    int size = mInData.length();



                    byte[] tempData = GsmAlphabet

                            .stringToGsm7BitPacked(mInData, 0, 0);

                    data = new byte[size];

                    // Since stringToGsm7BitPacked() set byte 0 in the

                    // returned byte array to the count of septets used...

                    // copy to a new array without byte 0.

                    System.arraycopy(tempData, 1, data, 0, size);

                    // The size of the new buffer will be smaller than the original buffer

                    // since 7-bit GSM packed only requires ((mInData.length * 7) + 7) / 8 bytes.

                    // And we don't need to copy/store the first byte from the returned array

                    // because it is used to store the count of septets used.

                    data = new byte[tempData.length - 1];

                    System.arraycopy(tempData, 1, data, 0, tempData.length - 1);

                } else {

                    data = GsmAlphabet.stringToGsm8BitPacked(mInData);

                }
@@ -139,7 +138,19 @@ class GetInkeyInputResponseData extends ResponseData { 
        }



        // length - one more for data coding scheme.



        // ETSI TS 102 223 Annex C (normative): Structure of CAT communications

        // Any length within the APDU limits (up to 255 bytes) can thus be encoded on two bytes.

        // This coding is chosen to remain compatible with TS 101.220.

        // Note that we need to reserve one more byte for coding scheme thus the maximum APDU

        // size would be 254 bytes.

        if (data.length + 1 <= 255) {

            writeLength(buf, data.length + 1);

        }

        else {

            data = new byte[0];

        }





        // data coding scheme

        if (mIsUcs2) {