diff options
author | lrichard <richardl@codeaurora.org> | 2013-10-29 14:55:30 +0800 |
---|---|---|
committer | Linux Build Service Account <lnxbuild@localhost> | 2015-10-06 03:20:13 -0600 |
commit | 1021d9a9da5a47095f6d9085ea341e6015215dc2 (patch) | |
tree | 72ba05b4e876456917b5f7a2359b42c2634bdc29 | |
parent | efca5300e65cc1d6179a954535087dea56011c80 (diff) | |
download | android_hardware_ril-1021d9a9da5a47095f6d9085ea341e6015215dc2.tar.gz android_hardware_ril-1021d9a9da5a47095f6d9085ea341e6015215dc2.tar.bz2 android_hardware_ril-1021d9a9da5a47095f6d9085ea341e6015215dc2.zip |
Add support for cdma dynamic address length.
Get the address,sub address,Bearer with dynamic length in the data parcel,
to avoid the OutOfBoundsException with the MAX macro.
Change-Id: I1d7437143c1369d77791136b68e06088acd72937
CRs-Fixed:543087
-rw-r--r-- | libril/ril.cpp | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/libril/ril.cpp b/libril/ril.cpp index 4424561..1661d18 100644 --- a/libril/ril.cpp +++ b/libril/ril.cpp @@ -1521,6 +1521,7 @@ static void dispatchRilCdmaSmsWriteArgs(Parcel &p, RequestInfo *pRI) { uint8_t uct; status_t status; int32_t digitCount; + int32_t digitLimit; memset(&rcsw, 0, sizeof(rcsw)); @@ -1551,7 +1552,9 @@ static void dispatchRilCdmaSmsWriteArgs(Parcel &p, RequestInfo *pRI) { status = p.read(&uct,sizeof(uct)); rcsw.message.sAddress.number_of_digits = (uint8_t) uct; - for(digitCount = 0 ; digitCount < RIL_CDMA_SMS_ADDRESS_MAX; digitCount ++) { + digitLimit = MIN((rcsw.message.sAddress.number_of_digits), RIL_CDMA_SMS_ADDRESS_MAX); + + for(digitCount = 0 ; digitCount < digitLimit; digitCount ++) { status = p.read(&uct,sizeof(uct)); rcsw.message.sAddress.digits[digitCount] = (uint8_t) uct; } @@ -1565,7 +1568,9 @@ static void dispatchRilCdmaSmsWriteArgs(Parcel &p, RequestInfo *pRI) { status = p.read(&uct,sizeof(uct)); rcsw.message.sSubAddress.number_of_digits = (uint8_t) uct; - for(digitCount = 0 ; digitCount < RIL_CDMA_SMS_SUBADDRESS_MAX; digitCount ++) { + digitLimit = MIN((rcsw.message.sSubAddress.number_of_digits), RIL_CDMA_SMS_SUBADDRESS_MAX); + + for(digitCount = 0 ; digitCount < digitLimit; digitCount ++) { status = p.read(&uct,sizeof(uct)); rcsw.message.sSubAddress.digits[digitCount] = (uint8_t) uct; } @@ -1573,7 +1578,9 @@ static void dispatchRilCdmaSmsWriteArgs(Parcel &p, RequestInfo *pRI) { status = p.readInt32(&t); rcsw.message.uBearerDataLen = (int) t; - for(digitCount = 0 ; digitCount < RIL_CDMA_SMS_BEARER_DATA_MAX; digitCount ++) { + digitLimit = MIN((rcsw.message.uBearerDataLen), RIL_CDMA_SMS_BEARER_DATA_MAX); + + for(digitCount = 0 ; digitCount < digitLimit; digitCount ++) { status = p.read(&uct, sizeof(uct)); rcsw.message.aBearerData[digitCount] = (uint8_t) uct; } |