summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSamuel Tan <samueltan@google.com>2016-07-19 17:35:57 -0700
committerJessica Wagantall <jwagantall@cyngn.com>2016-10-04 16:02:23 -0700
commit0378f69284723d075acb4f0ef1e4dfb5c21fc73a (patch)
tree6af65374e9de15bfa926c6e978ee21e1c409ecba
parentd8d22e1b882a02ca3a75cae08966a2f4e2ea46f4 (diff)
downloadandroid_frameworks_opt_net_wifi-0378f69284723d075acb4f0ef1e4dfb5c21fc73a.tar.gz
android_frameworks_opt_net_wifi-0378f69284723d075acb4f0ef1e4dfb5c21fc73a.tar.bz2
android_frameworks_opt_net_wifi-0378f69284723d075acb4f0ef1e4dfb5c21fc73a.zip
ANQPFactory: catch all potential parsing errors
The ANQP Element parsing code that parses untrusted data broadcasted by APs is currently untested, and might contain errors that will trigger exceptions that can crash the system service (e.g. null pointer exceptions). To contain this risk, catch all possible exceptions from the invoking ANQP element parsing code from ANQPFactory, and throw them again as ProtocolExceptions, which users of ANQPFactory already catch. CYNGNOS-3286 BUG: 30230534 Change-Id: Icaba02c0e6739d94482cf4a5e704b59f8d4105b4 (cherry picked from commit 6154eb070b9f224a8daebf0a852d61f07d2c5cf3) (cherry picked from commit bafabeb09d7c75ef205a5b2fcbd581be6b6e2771)
-rw-r--r--service/java/com/android/server/wifi/anqp/ANQPFactory.java158
1 files changed, 87 insertions, 71 deletions
diff --git a/service/java/com/android/server/wifi/anqp/ANQPFactory.java b/service/java/com/android/server/wifi/anqp/ANQPFactory.java
index 55f631073..deca9c6c6 100644
--- a/service/java/com/android/server/wifi/anqp/ANQPFactory.java
+++ b/service/java/com/android/server/wifi/anqp/ANQPFactory.java
@@ -158,83 +158,99 @@ public class ANQPFactory {
public static ANQPElement buildElement(ByteBuffer payload, Constants.ANQPElementType infoID,
int length) throws ProtocolException {
- ByteBuffer elementPayload = payload.duplicate().order(ByteOrder.LITTLE_ENDIAN);
- payload.position(payload.position() + length);
- elementPayload.limit(elementPayload.position() + length);
-
- switch (infoID) {
- case ANQPCapabilityList:
- return new CapabilityListElement(infoID, elementPayload);
- case ANQPVenueName:
- return new VenueNameElement(infoID, elementPayload);
- case ANQPEmergencyNumber:
- return new EmergencyNumberElement(infoID, elementPayload);
- case ANQPNwkAuthType:
- return new NetworkAuthenticationTypeElement(infoID, elementPayload);
- case ANQPRoamingConsortium:
- return new RoamingConsortiumElement(infoID, elementPayload);
- case ANQPIPAddrAvailability:
- return new IPAddressTypeAvailabilityElement(infoID, elementPayload);
- case ANQPNAIRealm:
- return new NAIRealmElement(infoID, elementPayload);
- case ANQP3GPPNetwork:
- return new ThreeGPPNetworkElement(infoID, elementPayload);
- case ANQPGeoLoc:
- return new GEOLocationElement(infoID, elementPayload);
- case ANQPCivicLoc:
- return new CivicLocationElement(infoID, elementPayload);
- case ANQPLocURI:
- return new GenericStringElement(infoID, elementPayload);
- case ANQPDomName:
- return new DomainNameElement(infoID, elementPayload);
- case ANQPEmergencyAlert:
- return new GenericStringElement(infoID, elementPayload);
- case ANQPTDLSCap:
- return new GenericBlobElement(infoID, elementPayload);
- case ANQPEmergencyNAI:
- return new GenericStringElement(infoID, elementPayload);
- case ANQPNeighborReport:
- return new GenericBlobElement(infoID, elementPayload);
- case ANQPVendorSpec:
- if (elementPayload.remaining() > 5) {
- int oi = elementPayload.getInt();
- if (oi != Constants.HS20_PREFIX) {
- return null;
- }
- int subType = elementPayload.get() & Constants.BYTE_MASK;
- Constants.ANQPElementType hs20ID = Constants.mapHS20Element(subType);
- if (hs20ID == null) {
- throw new ProtocolException("Bad HS20 info ID: " + subType);
- }
- elementPayload.get(); // Skip the reserved octet
- return buildHS20Element(hs20ID, elementPayload);
- } else {
+ try {
+ ByteBuffer elementPayload = payload.duplicate().order(ByteOrder.LITTLE_ENDIAN);
+ payload.position(payload.position() + length);
+ elementPayload.limit(elementPayload.position() + length);
+
+ switch (infoID) {
+ case ANQPCapabilityList:
+ return new CapabilityListElement(infoID, elementPayload);
+ case ANQPVenueName:
+ return new VenueNameElement(infoID, elementPayload);
+ case ANQPEmergencyNumber:
+ return new EmergencyNumberElement(infoID, elementPayload);
+ case ANQPNwkAuthType:
+ return new NetworkAuthenticationTypeElement(infoID, elementPayload);
+ case ANQPRoamingConsortium:
+ return new RoamingConsortiumElement(infoID, elementPayload);
+ case ANQPIPAddrAvailability:
+ return new IPAddressTypeAvailabilityElement(infoID, elementPayload);
+ case ANQPNAIRealm:
+ return new NAIRealmElement(infoID, elementPayload);
+ case ANQP3GPPNetwork:
+ return new ThreeGPPNetworkElement(infoID, elementPayload);
+ case ANQPGeoLoc:
+ return new GEOLocationElement(infoID, elementPayload);
+ case ANQPCivicLoc:
+ return new CivicLocationElement(infoID, elementPayload);
+ case ANQPLocURI:
+ return new GenericStringElement(infoID, elementPayload);
+ case ANQPDomName:
+ return new DomainNameElement(infoID, elementPayload);
+ case ANQPEmergencyAlert:
+ return new GenericStringElement(infoID, elementPayload);
+ case ANQPTDLSCap:
return new GenericBlobElement(infoID, elementPayload);
- }
- default:
- throw new ProtocolException("Unknown element ID: " + infoID);
+ case ANQPEmergencyNAI:
+ return new GenericStringElement(infoID, elementPayload);
+ case ANQPNeighborReport:
+ return new GenericBlobElement(infoID, elementPayload);
+ case ANQPVendorSpec:
+ if (elementPayload.remaining() > 5) {
+ int oi = elementPayload.getInt();
+ if (oi != Constants.HS20_PREFIX) {
+ return null;
+ }
+ int subType = elementPayload.get() & Constants.BYTE_MASK;
+ Constants.ANQPElementType hs20ID = Constants.mapHS20Element(subType);
+ if (hs20ID == null) {
+ throw new ProtocolException("Bad HS20 info ID: " + subType);
+ }
+ elementPayload.get(); // Skip the reserved octet
+ return buildHS20Element(hs20ID, elementPayload);
+ } else {
+ return new GenericBlobElement(infoID, elementPayload);
+ }
+ default:
+ throw new ProtocolException("Unknown element ID: " + infoID);
+ }
+ } catch (ProtocolException e) {
+ throw e;
+ } catch (Exception e) {
+ // TODO: remove this catch-all for exceptions, once the element parsing code
+ // has been thoroughly unit tested. b/30562650
+ throw new ProtocolException("Unknown parsing error", e);
}
}
public static ANQPElement buildHS20Element(Constants.ANQPElementType infoID,
ByteBuffer payload) throws ProtocolException {
- switch (infoID) {
- case HSCapabilityList:
- return new HSCapabilityListElement(infoID, payload);
- case HSFriendlyName:
- return new HSFriendlyNameElement(infoID, payload);
- case HSWANMetrics:
- return new HSWanMetricsElement(infoID, payload);
- case HSConnCapability:
- return new HSConnectionCapabilityElement(infoID, payload);
- case HSOperatingclass:
- return new GenericBlobElement(infoID, payload);
- case HSOSUProviders:
- return new HSOsuProvidersElement(infoID, payload);
- case HSIconFile:
- return new HSIconFileElement(infoID, payload);
- default:
- return null;
+ try {
+ switch (infoID) {
+ case HSCapabilityList:
+ return new HSCapabilityListElement(infoID, payload);
+ case HSFriendlyName:
+ return new HSFriendlyNameElement(infoID, payload);
+ case HSWANMetrics:
+ return new HSWanMetricsElement(infoID, payload);
+ case HSConnCapability:
+ return new HSConnectionCapabilityElement(infoID, payload);
+ case HSOperatingclass:
+ return new GenericBlobElement(infoID, payload);
+ case HSOSUProviders:
+ return new HSOsuProvidersElement(infoID, payload);
+ case HSIconFile:
+ return new HSIconFileElement(infoID, payload);
+ default:
+ return null;
+ }
+ } catch (ProtocolException e) {
+ throw e;
+ } catch (Exception e) {
+ // TODO: remove this catch-all for exceptions, once the element parsing code
+ // has been thoroughly unit tested. b/30562650
+ throw new ProtocolException("Unknown parsing error", e);
}
}
}