MiPad4/android_device_xiaomi_sdm660-common
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "Integer overflow leading to a buffer overflow"

Browse source
This commit is contained in:
qctecmdr 2019-04-01 22:11:09 -07:00 committed by Gerrit - the friendly Code Review server
commit 3e614934d1
2 changed files with 14 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
gnss/Agps.cpp
View file

@ -445,15 +445,14 @@ void AgpsStateMachine::setAPN(char* apn, unsigned int len){
if (NULL != mAPN) {
delete mAPN;
mAPN = NULL;
}
if (apn == NULL || len <= 0) {
if (NULL == apn || len <= 0 || len > MAX_APN_LEN || strlen(apn) != len) {
LOC_LOGD("Invalid apn len (%d) or null apn", len);
mAPN = NULL;
mAPNLen = 0;
}
if (NULL != apn) {
} else {
mAPN = new char[len+1];
if (NULL != mAPN) {
memcpy(mAPN, apn, len);

10
gnss/GnssAdapter.cpp
View file

@ -4054,6 +4054,8 @@ void GnssAdapter::dataConnOpenCommand(
LOC_LOGV("AgpsMsgAtlOpenSuccess");
if (mApnName == nullptr) {
LOC_LOGE("%s] new allocation failed, fatal error.", __func__);
// Reporting the failure here
mAgpsManager->reportAtlClosed(mAgpsType);
return;
}
memcpy(mApnName, apnName, apnLen);
@ -4070,10 +4072,16 @@ void GnssAdapter::dataConnOpenCommand(
mAgpsManager->reportAtlOpenSuccess(mAgpsType, mApnName, mApnLen, mBearerType);
}
};
// Added inital length checks for apnlen check to avoid security issues
// In case of failure reporting the same
if (NULL == apnName || apnLen <= 0 || apnLen > MAX_APN_LEN || (strlen(apnName) != apnLen)) {
LOC_LOGe("%s]: incorrect apnlen length or incorrect apnName", __func__);
mAgpsManager.reportAtlClosed(agpsType);
} else {
sendMsg( new AgpsMsgAtlOpenSuccess(
&mAgpsManager, agpsType, apnName, apnLen, bearerType));
}
}
void GnssAdapter::dataConnClosedCommand(AGpsExtType agpsType){