Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e8955271 authored by Pengquan Meng's avatar Pengquan Meng
Browse files

Fixed invalid pdu issue 

The device may receive invalid sms pdu, i.e the pdu contins sms header
with an invalid seqNumber. This caused InboundSmsHandler crashed constantly.
This CL added the range check for the seqNumber to ensure the
InboundSmsHandler will not crash even if the seqNumber is invalid.

Test: runtest -x GsmInboundSmsHandlerTest -m
testMultiPartSmsWithInvalidSeqNumber
Bug: 72298611

Merged-In: Icf291c8530abdc2a528c5cf227cf00135281b899
Change-Id: Icf291c8530abdc2a528c5cf227cf00135281b899
(cherry picked from commit 9eec9d02)
(cherry picked from commit d2f410c0)
parent d837aaa3

src/java/com/android/internal/telephony/InboundSmsHandler.java

+29 −0
Original line number Diff line number Diff line
@@ -82,6 +82,7 @@ import java.util.Arrays; 
import java.util.HashMap;

import java.util.List;

import java.util.Map;

import android.util.EventLog;



/**

 * This class broadcasts incoming SMS messages to interested apps after storing them in
@@ -744,6 +745,19 @@ public abstract class InboundSmsHandler extends StateMachine { 
        int destPort = tracker.getDestPort();

        boolean block = false;



        // Do not process when the message count is invalid.

        if (messageCount <= 0) {

            EventLog.writeEvent(

                    0x534e4554 /* snetTagId */,

                    "72298611" /* buganizer id */,

                    -1 /* uid */,

                    String.format(

                            "processMessagePart: invalid messageCount = %d",

                            messageCount));



            return false;

        }



        if (messageCount == 1) {

            // single-part message

            pdus = new byte[][]{tracker.getPdu()};
@@ -779,6 +793,21 @@ public abstract class InboundSmsHandler extends StateMachine { 
                    int index = cursor.getInt(PDU_SEQUENCE_PORT_PROJECTION_INDEX_MAPPING

                            .get(SEQUENCE_COLUMN)) - tracker.getIndexOffset();



                    // The invalid PDUs can be received and stored in the raw table. The range

                    // check ensures the process not crash even if the seqNumber in the

                    // UserDataHeader is invalid.

                    if (index >= pdus.length || index < 0) {

                        EventLog.writeEvent(

                                0x534e4554 /* snetTagId */,

                                "72298611" /* buganizer id */,

                                -1 /* uid */,

                                String.format(

                                        "processMessagePart: invalid seqNumber = %d, messageCount = %d",

                                        index + tracker.getIndexOffset(),

                                        messageCount));

                        continue;

                    }



                    pdus[index] = HexDump.hexStringToByteArray(cursor.getString(

                            PDU_SEQUENCE_PORT_PROJECTION_INDEX_MAPPING.get(PDU_COLUMN)));