summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSanket Padawe <sanketpadawe@google.com>2017-07-13 14:19:28 -0700
committerIvan Kutepov <its.kutepov@gmail.com>2017-10-04 15:51:59 +0300
commitf29d36b6b5430d3974b1857f8438d924c2f16a86 (patch)
tree77541d6bf0a78a4b2069e5f09dc62c8615457b92
parent37cd685a468ff06eb731bd878fc8b7ba6e92c4a2 (diff)
downloadandroid_hardware_ril-cm-13.0.tar.gz
android_hardware_ril-cm-13.0.tar.bz2
android_hardware_ril-cm-13.0.zip
Fix security vulnerability in pre-O rild code. Remove wrong code for setup_data_call. Add check for max address for RIL_DIAL. Bug: 37896655 Test: Manual. Change-Id: I05c027140ae828a2653794fcdd94e1b1a130941b (cherry picked from commit dda24c6557911aa1f4708abbd6b2f20f0e205b9e) CVE-2017-0823
-rw-r--r--libril/ril.cpp14
1 files changed, 7 insertions, 7 deletions
diff --git a/libril/ril.cpp b/libril/ril.cpp
index eda2d75..6937497 100644
--- a/libril/ril.cpp
+++ b/libril/ril.cpp
@@ -3990,12 +3990,12 @@ static void debugCallback (int fd, short flags, void *param) {
int data;
unsigned int qxdm_data[6];
const char *deactData[1] = {"1"};
- char *actData[1];
RIL_Dial dialData;
int hangupData[1] = {1};
int number;
char **args;
RIL_SOCKET_ID socket_id = RIL_SOCKET_1;
+ int MAX_DIAL_ADDRESS = 128;
int sim_id = 0;
RLOGI("debugCallback for socket %s", rilSocketIdToString(socket_id));
@@ -4114,12 +4114,6 @@ static void debugCallback (int fd, short flags, void *param) {
// Set network selection automatic.
issueLocalRequest(RIL_REQUEST_SET_NETWORK_SELECTION_AUTOMATIC, NULL, 0, socket_id);
break;
- case 6:
- RLOGI("Debug port: Setup Data Call, Apn :%s\n", args[1]);
- actData[0] = args[1];
- issueLocalRequest(RIL_REQUEST_SETUP_DATA_CALL, &actData,
- sizeof(actData), socket_id);
- break;
case 7:
RLOGI("Debug port: Deactivate Data Call");
issueLocalRequest(RIL_REQUEST_DEACTIVATE_DATA_CALL, &deactData,
@@ -4128,6 +4122,12 @@ static void debugCallback (int fd, short flags, void *param) {
case 8:
RLOGI("Debug port: Dial Call");
dialData.clir = 0;
+ if (strlen(args[1]) > MAX_DIAL_ADDRESS) {
+ RLOGE("Debug port: Error calling Dial");
+ freeDebugCallbackArgs(number, args);
+ close(acceptFD);
+ return;
+ }
dialData.address = args[1];
issueLocalRequest(RIL_REQUEST_DIAL, &dialData, sizeof(dialData), socket_id);
break;