From 6e8f89702f13d6465a9625f436c569a489e57156 Mon Sep 17 00:00:00 2001 From: Pengquan Meng Date: Fri, 23 Mar 2018 14:29:55 -0700 Subject: Fixed invalid pdu issue The device may receive invalid sms pdu, i.e the pdu contins sms header with an invalid seqNumber. This caused InboundSmsHandler crashed constantly. This CL added the range check for the seqNumber to ensure the InboundSmsHandler will not crash even if the seqNumber is invalid. Test: runtest -x GsmInboundSmsHandlerTest -m testMultiPartSmsWithInvalidSeqNumber Bug: 72298611 Merged-In: Icf291c8530abdc2a528c5cf227cf00135281b899 Change-Id: Icf291c8530abdc2a528c5cf227cf00135281b899 (cherry picked from commit 9eec9d02937dd41fc94ad1c874f8467f4698df5c) (cherry picked from commit d2f410c0ff07c5a7b79e61bc36527b0259677de7) (cherry picked from commit e8955271c5ca1595ae7c495b6cd7c5f8515d65ea) --- .../internal/telephony/InboundSmsHandler.java | 29 ++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/src/java/com/android/internal/telephony/InboundSmsHandler.java b/src/java/com/android/internal/telephony/InboundSmsHandler.java index 27ce3c0908..b7eb32aedf 100644 --- a/src/java/com/android/internal/telephony/InboundSmsHandler.java +++ b/src/java/com/android/internal/telephony/InboundSmsHandler.java @@ -82,6 +82,7 @@ import java.util.Arrays; import java.util.HashMap; import java.util.List; import java.util.Map; +import android.util.EventLog; /** * This class broadcasts incoming SMS messages to interested apps after storing them in @@ -744,6 +745,19 @@ public abstract class InboundSmsHandler extends StateMachine { int destPort = tracker.getDestPort(); boolean block = false; + // Do not process when the message count is invalid. + if (messageCount <= 0) { + EventLog.writeEvent( + 0x534e4554 /* snetTagId */, + "72298611" /* buganizer id */, + -1 /* uid */, + String.format( + "processMessagePart: invalid messageCount = %d", + messageCount)); + + return false; + } + if (messageCount == 1) { // single-part message pdus = new byte[][]{tracker.getPdu()}; @@ -779,6 +793,21 @@ public abstract class InboundSmsHandler extends StateMachine { int index = cursor.getInt(PDU_SEQUENCE_PORT_PROJECTION_INDEX_MAPPING .get(SEQUENCE_COLUMN)) - tracker.getIndexOffset(); + // The invalid PDUs can be received and stored in the raw table. The range + // check ensures the process not crash even if the seqNumber in the + // UserDataHeader is invalid. + if (index >= pdus.length || index < 0) { + EventLog.writeEvent( + 0x534e4554 /* snetTagId */, + "72298611" /* buganizer id */, + -1 /* uid */, + String.format( + "processMessagePart: invalid seqNumber = %d, messageCount = %d", + index + tracker.getIndexOffset(), + messageCount)); + continue; + } + pdus[index] = HexDump.hexStringToByteArray(cursor.getString( PDU_SEQUENCE_PORT_PROJECTION_INDEX_MAPPING.get(PDU_COLUMN))); -- cgit v1.2.3