summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorNingyuan Wang <nywang@google.com>2017-05-15 21:24:41 (GMT)
committerIvan Kutepov <its.kutepov@gmail.com>2017-08-13 15:56:47 (GMT)
commit2e1ff498017ee2e2a403fce604efe8947ed85411 (patch)
tree9701ade238e93608a558fd18793774a3a03c1003
parentcbb1f819c2f82af3e99e10dda29e216877a5187c (diff)
downloadandroid_frameworks_opt_net_wifi-cm-13.0.zip
android_frameworks_opt_net_wifi-cm-13.0.tar.gz
android_frameworks_opt_net_wifi-cm-13.0.tar.bz2
wifinative jni: check array length for trackSignificantWifiChangeHEADreplicant-6.0-0003replicant-6.0-0002cm-13.0
params.ap is an array with length MAX_SIGNIFICANT_CHANGE_APS == 64 We should check that params.num_ap does not exceed this value, otherwise this could be a stack overflow security vulnerability. CTS test is not available because CTS test doesn't have the privilege to access system API. Bug: 37207928 Test: compile Test: SafetyNet log not triggered under non-exploit conditions Change-Id: I541bacd5448124864f28ef1671edf065cc0e35ed (cherry picked from commit dc96644e72bbac7b579c3ac4b8c5beed1fe7f0b6)
-rw-r--r--service/jni/com_android_server_wifi_WifiNative.cpp10
1 files changed, 8 insertions, 2 deletions
diff --git a/service/jni/com_android_server_wifi_WifiNative.cpp b/service/jni/com_android_server_wifi_WifiNative.cpp
index 3242888..d7381dd 100644
--- a/service/jni/com_android_server_wifi_WifiNative.cpp
+++ b/service/jni/com_android_server_wifi_WifiNative.cpp
@@ -43,6 +43,7 @@
namespace android {
static jint DBG = false;
+constexpr int SAFE_NET_LOG_ID = 0x534e4554;
//Please put all HAL function call here and call from the function table instead of directly call
static wifi_hal_fn hal_fn;
@@ -895,7 +896,7 @@ static jboolean android_net_wifi_setHotlist(
if (params.num_bssid >
static_cast<int>(sizeof(params.ap) / sizeof(params.ap[0]))) {
ALOGE("setHotlist array length is too long");
- android_errorWriteLog(0x534e4554, "31856351");
+ android_errorWriteLog(SAFE_NET_LOG_ID, "31856351");
return false;
}
@@ -1013,7 +1014,12 @@ static jboolean android_net_wifi_trackSignificantWifiChange(
ALOGE("Error in accessing array");
return false;
}
-
+ if (params.num_bssid >
+ static_cast<int>(sizeof(params.ap) / sizeof(params.ap[0]))) {
+ ALOGE("trackSignificantWifiChange array length is too long");
+ android_errorWriteLog(SAFE_NET_LOG_ID, "37775935");
+ return false;
+ }
ALOGD("Initialized common fields %d, %d, %d, %d", params.rssi_sample_size,
params.lost_ap_sample_size, params.min_breaching, params.num_bssid);