MiPad4/android_device_xiaomi_sdm660-common
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add buffer length check for XTRA data

Browse source 
To prevent reading beyond the length of
the buffer that contains XTRA data, a
check has been introduced assuming an
approximate limit for the size of the
data

Change-Id: I7e05beadec76c3308448b9198fd23c8e8b97394d
CRs-fixed: 420623
This commit is contained in:
Tushar Janefalkar 2012-11-14 11:32:40 -08:00
parent a5cc98e78f
commit 0b0b89fbd6
2 changed files with 9 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
loc_api/libloc_api_50001/loc.cpp
View file

@ -855,8 +855,12 @@ SIDE EFFECTS
static int loc_xtra_inject_data(char* data, int length) static int loc_xtra_inject_data(char* data, int length)
{ {
ENTRY_LOG(); ENTRY_LOG();
int ret_val = loc_eng_xtra_inject_data(loc_afw_data, data, length); int ret_val = -1;
if( (data != NULL) && ((unsigned int)length <= XTRA_DATA_MAX_SIZE))
ret_val = loc_eng_xtra_inject_data(loc_afw_data, data, length);
else
LOC_LOGE("%s, Could not inject XTRA data. Buffer address: %p, length: %d",
__func__, data, length);
EXIT_LOG(%d, ret_val); EXIT_LOG(%d, ret_val);
return ret_val; return ret_val;
} }

4
loc_api/libloc_api_50001/loc.h
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2011-2013, The Linux Foundation. All rights reserved. /* Copyright (c) 2011,2014 The Linux Foundation. All rights reserved.
* *
* Redistribution and use in source and binary forms, with or without * Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are * modification, are permitted provided that the following conditions are
@ -39,6 +39,8 @@ extern "C" {
#include <hardware/gps.h> #include <hardware/gps.h>
#include <gps_extended.h> #include <gps_extended.h>
#define XTRA_DATA_MAX_SIZE 100000 /*bytes*/
typedef void (*loc_location_cb_ext) (UlpLocation* location, void* locExt); typedef void (*loc_location_cb_ext) (UlpLocation* location, void* locExt);
typedef void (*loc_sv_status_cb_ext) (GpsSvStatus* sv_status, void* svExt); typedef void (*loc_sv_status_cb_ext) (GpsSvStatus* sv_status, void* svExt);
typedef void* (*loc_ext_parser)(void* data); typedef void* (*loc_ext_parser)(void* data);