[automerger] Fixed Invalid Pdu Issue am: 4b938358de (fc2a2d07) · Commits · e / os / android_frameworks_opt_telephony

src/java/com/android/internal/telephony/InboundSmsHandler.java

+29 −0

Original line number	Diff line number	Diff line
		@@ -66,6 +66,7 @@ import android.telephony.SmsMessage;
		import android.telephony.SubscriptionManager;
		import android.telephony.TelephonyManager;
		import android.text.TextUtils;
		import android.util.EventLog;

		import com.android.internal.telephony.uicc.UiccCard;
		import com.android.internal.telephony.uicc.UiccController;
		@@ -691,6 +692,18 @@ public abstract class InboundSmsHandler extends StateMachine {
		byte[][] pdus;
		int destPort = tracker.getDestPort();

		// Do not process when the message count is invalid.
		if (messageCount <= 0) {
		EventLog.writeEvent(
		0x534e4554 /* snetTagId */,
		"72298611" /* buganizer id */,
		-1 /* uid */,
		String.format(
		"processMessagePart: invalid messageCount = %d",
		messageCount));
		return false;
		}

		if (messageCount == 1) {
		// single-part message
		pdus = new byte[][]{tracker.getPdu()};
		@@ -724,6 +737,22 @@ public abstract class InboundSmsHandler extends StateMachine {
		// subtract offset to convert sequence to 0-based array index
		int index = cursor.getInt(SEQUENCE_COLUMN) - tracker.getIndexOffset();

		// The invalid PDUs can be received and stored in the raw table. The range
		// check ensures the process not crash even if the seqNumber in the
		// UserDataHeader is invalid.
		if (index >= pdus.length \|\| index < 0) {
		EventLog.writeEvent(
		0x534e4554 /* snetTagId */,
		"72298611" /* buganizer id */,
		-1 /* uid */,
		String.format(
		"processMessagePart: invalid seqNumber = %d, "
		+ "messageCount = %d",
		index + tracker.getIndexOffset(),
		messageCount));
		continue;
		}

		pdus[index] = HexDump.hexStringToByteArray(cursor.getString(PDU_COLUMN));

		// Read the destination port from the first segment (needed for CDMA WAP PDU).