summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSamuel Tan <samueltan@google.com>2016-07-20 00:35:57 (GMT)
committergitbuildkicker <android-build@google.com>2016-08-26 23:22:02 (GMT)
commit47c5adba752a951243ee696ce5f1ee3f302a42ab (patch)
treeaa9b7a6ef3e09931355bec577b68ed307374cb29
parentfc6c67ccf3f1819e90cfd0f10408a2724fbaff97 (diff)
downloadandroid_frameworks_opt_net_wifi-47c5adba752a951243ee696ce5f1ee3f302a42ab.zip
android_frameworks_opt_net_wifi-47c5adba752a951243ee696ce5f1ee3f302a42ab.tar.gz
android_frameworks_opt_net_wifi-47c5adba752a951243ee696ce5f1ee3f302a42ab.tar.bz2
ANQPFactory: catch all potential parsing errors
The ANQP Element parsing code that parses untrusted data broadcasted by APs is currently untested, and might contain errors that will trigger exceptions that can crash the system service (e.g. null pointer exceptions). To contain this risk, catch all possible exceptions from the invoking ANQP element parsing code from ANQPFactory, and throw them again as ProtocolExceptions, which users of ANQPFactory already catch. BUG: 30230534 Change-Id: Icaba02c0e6739d94482cf4a5e704b59f8d4105b4 (cherry picked from commit 6154eb070b9f224a8daebf0a852d61f07d2c5cf3)
-rw-r--r--service/java/com/android/server/wifi/anqp/ANQPFactory.java158
1 files changed, 87 insertions, 71 deletions
diff --git a/service/java/com/android/server/wifi/anqp/ANQPFactory.java b/service/java/com/android/server/wifi/anqp/ANQPFactory.java
index 55f6310..deca9c6 100644
--- a/service/java/com/android/server/wifi/anqp/ANQPFactory.java
+++ b/service/java/com/android/server/wifi/anqp/ANQPFactory.java
@@ -158,83 +158,99 @@ public class ANQPFactory {
public static ANQPElement buildElement(ByteBuffer payload, Constants.ANQPElementType infoID,
int length) throws ProtocolException {
- ByteBuffer elementPayload = payload.duplicate().order(ByteOrder.LITTLE_ENDIAN);
- payload.position(payload.position() + length);
- elementPayload.limit(elementPayload.position() + length);
-
- switch (infoID) {
- case ANQPCapabilityList:
- return new CapabilityListElement(infoID, elementPayload);
- case ANQPVenueName:
- return new VenueNameElement(infoID, elementPayload);
- case ANQPEmergencyNumber:
- return new EmergencyNumberElement(infoID, elementPayload);
- case ANQPNwkAuthType:
- return new NetworkAuthenticationTypeElement(infoID, elementPayload);
- case ANQPRoamingConsortium:
- return new RoamingConsortiumElement(infoID, elementPayload);
- case ANQPIPAddrAvailability:
- return new IPAddressTypeAvailabilityElement(infoID, elementPayload);
- case ANQPNAIRealm:
- return new NAIRealmElement(infoID, elementPayload);
- case ANQP3GPPNetwork:
- return new ThreeGPPNetworkElement(infoID, elementPayload);
- case ANQPGeoLoc:
- return new GEOLocationElement(infoID, elementPayload);
- case ANQPCivicLoc:
- return new CivicLocationElement(infoID, elementPayload);
- case ANQPLocURI:
- return new GenericStringElement(infoID, elementPayload);
- case ANQPDomName:
- return new DomainNameElement(infoID, elementPayload);
- case ANQPEmergencyAlert:
- return new GenericStringElement(infoID, elementPayload);
- case ANQPTDLSCap:
- return new GenericBlobElement(infoID, elementPayload);
- case ANQPEmergencyNAI:
- return new GenericStringElement(infoID, elementPayload);
- case ANQPNeighborReport:
- return new GenericBlobElement(infoID, elementPayload);
- case ANQPVendorSpec:
- if (elementPayload.remaining() > 5) {
- int oi = elementPayload.getInt();
- if (oi != Constants.HS20_PREFIX) {
- return null;
- }
- int subType = elementPayload.get() & Constants.BYTE_MASK;
- Constants.ANQPElementType hs20ID = Constants.mapHS20Element(subType);
- if (hs20ID == null) {
- throw new ProtocolException("Bad HS20 info ID: " + subType);
- }
- elementPayload.get(); // Skip the reserved octet
- return buildHS20Element(hs20ID, elementPayload);
- } else {
+ try {
+ ByteBuffer elementPayload = payload.duplicate().order(ByteOrder.LITTLE_ENDIAN);
+ payload.position(payload.position() + length);
+ elementPayload.limit(elementPayload.position() + length);
+
+ switch (infoID) {
+ case ANQPCapabilityList:
+ return new CapabilityListElement(infoID, elementPayload);
+ case ANQPVenueName:
+ return new VenueNameElement(infoID, elementPayload);
+ case ANQPEmergencyNumber:
+ return new EmergencyNumberElement(infoID, elementPayload);
+ case ANQPNwkAuthType:
+ return new NetworkAuthenticationTypeElement(infoID, elementPayload);
+ case ANQPRoamingConsortium:
+ return new RoamingConsortiumElement(infoID, elementPayload);
+ case ANQPIPAddrAvailability:
+ return new IPAddressTypeAvailabilityElement(infoID, elementPayload);
+ case ANQPNAIRealm:
+ return new NAIRealmElement(infoID, elementPayload);
+ case ANQP3GPPNetwork:
+ return new ThreeGPPNetworkElement(infoID, elementPayload);
+ case ANQPGeoLoc:
+ return new GEOLocationElement(infoID, elementPayload);
+ case ANQPCivicLoc:
+ return new CivicLocationElement(infoID, elementPayload);
+ case ANQPLocURI:
+ return new GenericStringElement(infoID, elementPayload);
+ case ANQPDomName:
+ return new DomainNameElement(infoID, elementPayload);
+ case ANQPEmergencyAlert:
+ return new GenericStringElement(infoID, elementPayload);
+ case ANQPTDLSCap:
return new GenericBlobElement(infoID, elementPayload);
- }
- default:
- throw new ProtocolException("Unknown element ID: " + infoID);
+ case ANQPEmergencyNAI:
+ return new GenericStringElement(infoID, elementPayload);
+ case ANQPNeighborReport:
+ return new GenericBlobElement(infoID, elementPayload);
+ case ANQPVendorSpec:
+ if (elementPayload.remaining() > 5) {
+ int oi = elementPayload.getInt();
+ if (oi != Constants.HS20_PREFIX) {
+ return null;
+ }
+ int subType = elementPayload.get() & Constants.BYTE_MASK;
+ Constants.ANQPElementType hs20ID = Constants.mapHS20Element(subType);
+ if (hs20ID == null) {
+ throw new ProtocolException("Bad HS20 info ID: " + subType);
+ }
+ elementPayload.get(); // Skip the reserved octet
+ return buildHS20Element(hs20ID, elementPayload);
+ } else {
+ return new GenericBlobElement(infoID, elementPayload);
+ }
+ default:
+ throw new ProtocolException("Unknown element ID: " + infoID);
+ }
+ } catch (ProtocolException e) {
+ throw e;
+ } catch (Exception e) {
+ // TODO: remove this catch-all for exceptions, once the element parsing code
+ // has been thoroughly unit tested. b/30562650
+ throw new ProtocolException("Unknown parsing error", e);
}
}
public static ANQPElement buildHS20Element(Constants.ANQPElementType infoID,
ByteBuffer payload) throws ProtocolException {
- switch (infoID) {
- case HSCapabilityList:
- return new HSCapabilityListElement(infoID, payload);
- case HSFriendlyName:
- return new HSFriendlyNameElement(infoID, payload);
- case HSWANMetrics:
- return new HSWanMetricsElement(infoID, payload);
- case HSConnCapability:
- return new HSConnectionCapabilityElement(infoID, payload);
- case HSOperatingclass:
- return new GenericBlobElement(infoID, payload);
- case HSOSUProviders:
- return new HSOsuProvidersElement(infoID, payload);
- case HSIconFile:
- return new HSIconFileElement(infoID, payload);
- default:
- return null;
+ try {
+ switch (infoID) {
+ case HSCapabilityList:
+ return new HSCapabilityListElement(infoID, payload);
+ case HSFriendlyName:
+ return new HSFriendlyNameElement(infoID, payload);
+ case HSWANMetrics:
+ return new HSWanMetricsElement(infoID, payload);
+ case HSConnCapability:
+ return new HSConnectionCapabilityElement(infoID, payload);
+ case HSOperatingclass:
+ return new GenericBlobElement(infoID, payload);
+ case HSOSUProviders:
+ return new HSOsuProvidersElement(infoID, payload);
+ case HSIconFile:
+ return new HSIconFileElement(infoID, payload);
+ default:
+ return null;
+ }
+ } catch (ProtocolException e) {
+ throw e;
+ } catch (Exception e) {
+ // TODO: remove this catch-all for exceptions, once the element parsing code
+ // has been thoroughly unit tested. b/30562650
+ throw new ProtocolException("Unknown parsing error", e);
}
}
}