Merge "DO NOT MERGE Fix security vulnerability in pre-O rild code." into nyc-dev

[android-x86/hardware-ril.git] / libril / ril.cpp

diff --git a/libril/ril.cpp b/libril/ril.cpp
old mode 100755 (executable)
new mode 100644 (file)
index 7a469c1..0803563
--- a/libril/ril.cpp
+++ b/libril/ril.cpp
@@ -1332,7 +1332,7 @@ dispatchImsGsmSms(Parcel &p, RequestInfo *pRI, uint8_t retry, int32_t messageRef
         pStrings = NULL;
         datalen = 0;
     } else {
-        if (countStrings > (INT_MAX/sizeof(char *))) {
+        if ((size_t)countStrings > (INT_MAX/sizeof(char *))) {
             RLOGE("Invalid value of countStrings: \n");
             closeRequest;
             return;
@@ -2181,34 +2181,39 @@ static void dispatchCarrierRestrictions(Parcel &p, RequestInfo *pRI) {
     cr.len_excluded_carriers = t;
     cr.excluded_carriers = excluded_carriers;
 
+    startRequest;
+    appendPrintBuf("%s len_allowed_carriers:%d, len_excluded_carriers:%d,",
+                   printBuf, cr.len_allowed_carriers, cr.len_excluded_carriers);
+
+    appendPrintBuf("%s allowed_carriers:", printBuf);
     for (int32_t i = 0; i < cr.len_allowed_carriers; i++) {
         RIL_Carrier *p_cr = allowed_carriers + i;
-        p_cr->mcc = p.readCString();
-        p_cr->mnc = p.readCString();
+        p_cr->mcc = strdupReadString(p);
+        p_cr->mnc = strdupReadString(p);
         status = p.readInt32(&t);
         p_cr->match_type = static_cast<RIL_CarrierMatchType>(t);
         if (status != NO_ERROR) {
             goto invalid;
         }
-        p_cr->match_data = p.readCString();
+        p_cr->match_data = strdupReadString(p);
+        appendPrintBuf("%s [%d mcc:%s, mnc:%s, match_type:%d, match_data:%s],",
+                       printBuf, i, p_cr->mcc, p_cr->mnc, p_cr->match_type, p_cr->match_data);
     }
 
     for (int32_t i = 0; i < cr.len_excluded_carriers; i++) {
         RIL_Carrier *p_cr = excluded_carriers + i;
-        p_cr->mcc = p.readCString();
-        p_cr->mnc = p.readCString();
+        p_cr->mcc = strdupReadString(p);
+        p_cr->mnc = strdupReadString(p);
         status = p.readInt32(&t);
         p_cr->match_type = static_cast<RIL_CarrierMatchType>(t);
         if (status != NO_ERROR) {
             goto invalid;
         }
-        p_cr->match_data = p.readCString();
+        p_cr->match_data = strdupReadString(p);
+        appendPrintBuf("%s [%d mcc:%s, mnc:%s, match_type:%d, match_data:%s],",
+                       printBuf, i, p_cr->mcc, p_cr->mnc, p_cr->match_type, p_cr->match_data);
     }
 
-    startRequest;
-    appendPrintBuf("%s [len_allowed_carriers:%d, len_excluded_carriers:%d]",
-                   printBuf, cr.len_allowed_carriers, cr.len_excluded_carriers);
-
     closeRequest;
     printRequest(pRI->token, pRI->pCI->requestNumber);
 
@@ -3980,8 +3985,8 @@ static int responseLceStatus(Parcel &p, void *response, size_t responselen) {
       RLOGE("invalid response: NULL");
     }
     else {
-      RLOGE("responseLceStatus: invalid response length %d expecting len: d%",
-            sizeof(RIL_LceStatusInfo), responselen);
+      RLOGE("responseLceStatus: invalid response length %u expecting len: %u",
+            (unsigned)sizeof(RIL_LceStatusInfo), (unsigned)responselen);
     }
     return RIL_ERRNO_INVALID_RESPONSE;
   }
@@ -4004,8 +4009,8 @@ static int responseLceData(Parcel &p, void *response, size_t responselen) {
       RLOGE("invalid response: NULL");
     }
     else {
-      RLOGE("responseLceData: invalid response length %d expecting len: d%",
-            sizeof(RIL_LceDataInfo), responselen);
+      RLOGE("responseLceData: invalid response length %u expecting len: %u",
+            (unsigned)sizeof(RIL_LceDataInfo), (unsigned)responselen);
     }
     return RIL_ERRNO_INVALID_RESPONSE;
   }
@@ -4033,8 +4038,8 @@ static int responseActivityData(Parcel &p, void *response, size_t responselen) {
       RLOGE("invalid response: NULL");
     }
     else {
-      RLOGE("responseActivityData: invalid response length %d expecting len: d%",
-            sizeof(RIL_ActivityStatsInfo), responselen);
+      RLOGE("responseActivityData: invalid response length %u expecting len: %u",
+            (unsigned)sizeof(RIL_ActivityStatsInfo), (unsigned)responselen);
     }
     return RIL_ERRNO_INVALID_RESPONSE;
   }
@@ -4064,32 +4069,41 @@ static int responseCarrierRestrictions(Parcel &p, void *response, size_t respons
     return RIL_ERRNO_INVALID_RESPONSE;
   }
   if (responselen != sizeof(RIL_CarrierRestrictions)) {
-    RLOGE("responseCarrierRestrictions: invalid response length %d expecting len: %d",
-          responselen, sizeof(RIL_CarrierRestrictions));
+    RLOGE("responseCarrierRestrictions: invalid response length %u expecting len: %u",
+          (unsigned)responselen, (unsigned)sizeof(RIL_CarrierRestrictions));
     return RIL_ERRNO_INVALID_RESPONSE;
   }
 
   RIL_CarrierRestrictions *p_cr = (RIL_CarrierRestrictions *)response;
-  p.writeUint32(p_cr->len_allowed_carriers);
-  p.writeUint32(p_cr->len_excluded_carriers);
-  for(uint_t i = 0; i < p_cr->len_allowed_carriers; i++) {
+  startResponse;
+
+  p.writeInt32(p_cr->len_allowed_carriers);
+  p.writeInt32(p_cr->len_excluded_carriers);
+  appendPrintBuf(" %s len_allowed_carriers: %d, len_excluded_carriers: %d,", printBuf,
+                 p_cr->len_allowed_carriers,p_cr->len_excluded_carriers);
+
+  appendPrintBuf(" %s allowed_carriers:", printBuf);
+  for(int32_t i = 0; i < p_cr->len_allowed_carriers; i++) {
     RIL_Carrier *carrier = p_cr->allowed_carriers + i;
-    p.writeCString(carrier->mcc);
-    p.writeCString(carrier->mnc);
+    writeStringToParcel(p, carrier->mcc);
+    writeStringToParcel(p, carrier->mnc);
     p.writeInt32(carrier->match_type);
-    p.writeCString(carrier->match_data);
+    writeStringToParcel(p, carrier->match_data);
+    appendPrintBuf(" %s [%d mcc: %s, mnc: %s, match_type: %d, match_data: %s],", printBuf,
+                   i, carrier->mcc, carrier->mnc, carrier->match_type, carrier->match_data);
   }
-  for(uint_t i = 0; i < p_cr->len_excluded_carriers; i++) {
+
+  appendPrintBuf(" %s excluded_carriers:", printBuf);
+  for(int32_t i = 0; i < p_cr->len_excluded_carriers; i++) {
     RIL_Carrier *carrier = p_cr->excluded_carriers + i;
-    p.writeCString(carrier->mcc);
-    p.writeCString(carrier->mnc);
+    writeStringToParcel(p, carrier->mcc);
+    writeStringToParcel(p, carrier->mnc);
     p.writeInt32(carrier->match_type);
-    p.writeCString(carrier->match_data);
+    writeStringToParcel(p, carrier->match_data);
+    appendPrintBuf(" %s [%d mcc: %s, mnc: %s, match_type: %d, match_data: %s],", printBuf,
+                   i, carrier->mcc, carrier->mnc, carrier->match_type, carrier->match_data);
   }
 
-  startResponse;
-  appendPrintBuf("CarrierRestrictions received: len_allowed_carriers %d len_excluded_carriers %d",
-                  p_cr->len_allowed_carriers,p_cr->len_excluded_carriers);
   closeResponse;
 
   return 0;
@@ -4101,8 +4115,8 @@ static int responsePcoData(Parcel &p, void *response, size_t responselen) {
     return RIL_ERRNO_INVALID_RESPONSE;
   }
   if (responselen != sizeof(RIL_PCO_Data)) {
-    RLOGE("responsePcoData: invalid response length %d, expecting %d",
-          responselen, sizeof(RIL_PCO_Data));
+    RLOGE("responsePcoData: invalid response length %u, expecting %u",
+          (unsigned)responselen, (unsigned)sizeof(RIL_PCO_Data));
     return RIL_ERRNO_INVALID_RESPONSE;
   }
 
@@ -4267,7 +4281,7 @@ static void listenCallback (int fd, short flags, void *param) {
     int err;
     int is_phone_socket;
     int fdCommand = -1;
-    char* processName;
+    const char* processName;
     RecordStream *p_rs;
     MySocketListenParam* listenParam;
     RilSocket *sapSocket = NULL;
@@ -4405,12 +4419,12 @@ static void debugCallback (int fd, short flags, void *param) {
     int data;
     unsigned int qxdm_data[6];
     const char *deactData[1] = {"1"};
-    char *actData[1];
     RIL_Dial dialData;
     int hangupData[1] = {1};
     int number;
     char **args;
     RIL_SOCKET_ID socket_id = RIL_SOCKET_1;
+    int MAX_DIAL_ADDRESS = 128;
     int sim_id = 0;
 
     RLOGI("debugCallback for socket %s", rilSocketIdToString(socket_id));
@@ -4557,12 +4571,6 @@ static void debugCallback (int fd, short flags, void *param) {
             // Set network selection automatic.
             issueLocalRequest(RIL_REQUEST_SET_NETWORK_SELECTION_AUTOMATIC, NULL, 0, socket_id);
             break;
-        case 6:
-            RLOGI("Debug port: Setup Data Call, Apn :%s\n", args[1]);
-            actData[0] = args[1];
-            issueLocalRequest(RIL_REQUEST_SETUP_DATA_CALL, &actData,
-                              sizeof(actData), socket_id);
-            break;
         case 7:
             RLOGI("Debug port: Deactivate Data Call");
             issueLocalRequest(RIL_REQUEST_DEACTIVATE_DATA_CALL, &deactData,
@@ -4571,6 +4579,12 @@ static void debugCallback (int fd, short flags, void *param) {
         case 8:
             RLOGI("Debug port: Dial Call");
             dialData.clir = 0;
+            if (strlen(args[1]) > MAX_DIAL_ADDRESS) {
+                RLOGE("Debug port: Error calling Dial");
+                freeDebugCallbackArgs(number, args);
+                close(acceptFD);
+                return;
+            }
             dialData.address = args[1];
             issueLocalRequest(RIL_REQUEST_DIAL, &dialData, sizeof(dialData), socket_id);
             break;
@@ -4769,7 +4783,8 @@ RIL_register (const RIL_RadioFunctions *callbacks) {
                         &s_commands_event,        /* commands_event */
                         &s_listen_event,          /* listen_event */
                         processCommandsCallback,  /* processCommandsCallback */
-                        NULL                      /* p_rs */
+                        NULL,                     /* p_rs */
+                        RIL_TELEPHONY_SOCKET      /* type */
                         };
 
 #if (SIM_COUNT >= 2)
@@ -4781,7 +4796,8 @@ RIL_register (const RIL_RadioFunctions *callbacks) {
                         &s_commands_event_socket2,  /* commands_event */
                         &s_listen_event_socket2,    /* listen_event */
                         processCommandsCallback,    /* processCommandsCallback */
-                        NULL                        /* p_rs */
+                        NULL,                       /* p_rs */
+                        RIL_TELEPHONY_SOCKET        /* type */
                         };
 #endif
 
@@ -4794,7 +4810,8 @@ RIL_register (const RIL_RadioFunctions *callbacks) {
                         &s_commands_event_socket3,  /* commands_event */
                         &s_listen_event_socket3,    /* listen_event */
                         processCommandsCallback,    /* processCommandsCallback */
-                        NULL                        /* p_rs */
+                        NULL,                       /* p_rs */
+                        RIL_TELEPHONY_SOCKET        /* type */
                         };
 #endif
 
@@ -4807,7 +4824,8 @@ RIL_register (const RIL_RadioFunctions *callbacks) {
                         &s_commands_event_socket4,  /* commands_event */
                         &s_listen_event_socket4,    /* listen_event */
                         processCommandsCallback,    /* processCommandsCallback */
-                        NULL                        /* p_rs */
+                        NULL,                       /* p_rs */
+                        RIL_TELEPHONY_SOCKET        /* type */
                         };
 #endif
 
@@ -4910,6 +4928,8 @@ RIL_register_socket (RIL_RadioFunctions *(*Init)(const struct RIL_Env *, int, ch
 #if (SIM_COUNT >= 4)
                 RilSapSocket::initSapSocket("sap_uim_socket4", UimFuncs);
 #endif
+                break;
+            default:;
         }
     }
 }