OSDN Git Service

Merge "DO NOT MERGE Fix security vulnerability in pre-O rild code." into nyc-dev
[android-x86/hardware-ril.git] / libril / ril.cpp
old mode 100755 (executable)
new mode 100644 (file)
index b9e0f79..0803563
@@ -316,6 +316,7 @@ static int responseLceStatus(Parcel &p, void *response, size_t responselen);
 static int responseLceData(Parcel &p, void *response, size_t responselen);
 static int responseActivityData(Parcel &p, void *response, size_t responselen);
 static int responseCarrierRestrictions(Parcel &p, void *response, size_t responselen);
+static int responsePcoData(Parcel &p, void *response, size_t responselen);
 
 static int decodeVoiceRadioTechnology (RIL_RadioState radioState);
 static int decodeCdmaSubscriptionSource (RIL_RadioState radioState);
@@ -1331,7 +1332,7 @@ dispatchImsGsmSms(Parcel &p, RequestInfo *pRI, uint8_t retry, int32_t messageRef
         pStrings = NULL;
         datalen = 0;
     } else {
-        if (countStrings > (INT_MAX/sizeof(char *))) {
+        if ((size_t)countStrings > (INT_MAX/sizeof(char *))) {
             RLOGE("Invalid value of countStrings: \n");
             closeRequest;
             return;
@@ -2149,9 +2150,9 @@ static void dispatchCarrierRestrictions(Parcel &p, RequestInfo *pRI) {
 
     memset(&cr, 0, sizeof(RIL_CarrierRestrictions));
 
-    if (s_callbacks.version < 13) {
+    if (s_callbacks.version < 14) {
         RLOGE("Unsuppoted RIL version %d, min version expected %d",
-              s_callbacks.version, 13);
+              s_callbacks.version, 14);
         RIL_onRequestComplete(pRI, RIL_E_REQUEST_NOT_SUPPORTED, NULL, 0);
         return;
     }
@@ -2180,34 +2181,39 @@ static void dispatchCarrierRestrictions(Parcel &p, RequestInfo *pRI) {
     cr.len_excluded_carriers = t;
     cr.excluded_carriers = excluded_carriers;
 
+    startRequest;
+    appendPrintBuf("%s len_allowed_carriers:%d, len_excluded_carriers:%d,",
+                   printBuf, cr.len_allowed_carriers, cr.len_excluded_carriers);
+
+    appendPrintBuf("%s allowed_carriers:", printBuf);
     for (int32_t i = 0; i < cr.len_allowed_carriers; i++) {
         RIL_Carrier *p_cr = allowed_carriers + i;
-        p_cr->mcc = p.readCString();
-        p_cr->mnc = p.readCString();
+        p_cr->mcc = strdupReadString(p);
+        p_cr->mnc = strdupReadString(p);
         status = p.readInt32(&t);
         p_cr->match_type = static_cast<RIL_CarrierMatchType>(t);
         if (status != NO_ERROR) {
             goto invalid;
         }
-        p_cr->match_data = p.readCString();
+        p_cr->match_data = strdupReadString(p);
+        appendPrintBuf("%s [%d mcc:%s, mnc:%s, match_type:%d, match_data:%s],",
+                       printBuf, i, p_cr->mcc, p_cr->mnc, p_cr->match_type, p_cr->match_data);
     }
 
     for (int32_t i = 0; i < cr.len_excluded_carriers; i++) {
         RIL_Carrier *p_cr = excluded_carriers + i;
-        p_cr->mcc = p.readCString();
-        p_cr->mnc = p.readCString();
+        p_cr->mcc = strdupReadString(p);
+        p_cr->mnc = strdupReadString(p);
         status = p.readInt32(&t);
         p_cr->match_type = static_cast<RIL_CarrierMatchType>(t);
         if (status != NO_ERROR) {
             goto invalid;
         }
-        p_cr->match_data = p.readCString();
+        p_cr->match_data = strdupReadString(p);
+        appendPrintBuf("%s [%d mcc:%s, mnc:%s, match_type:%d, match_data:%s],",
+                       printBuf, i, p_cr->mcc, p_cr->mnc, p_cr->match_type, p_cr->match_data);
     }
 
-    startRequest;
-    appendPrintBuf("%s [len_allowed_carriers:%d, len_excluded_carriers:%d]",
-                   printBuf, cr.len_allowed_carriers, cr.len_excluded_carriers);
-
     closeRequest;
     printRequest(pRI->token, pRI->pCI->requestNumber);
 
@@ -3165,9 +3171,10 @@ static int responseRilSignalStrength(Parcel &p,
         return RIL_ERRNO_INVALID_RESPONSE;
     }
 
+    RIL_SignalStrength_v10 *p_cur;
     if (s_callbacks.version <= LAST_IMPRECISE_RIL_VERSION) {
         if (responselen >= sizeof (RIL_SignalStrength_v5)) {
-            RIL_SignalStrength_v10 *p_cur = ((RIL_SignalStrength_v10 *) response);
+            p_cur = ((RIL_SignalStrength_v10 *) response);
 
             responseRilSignalStrengthV5(p, p_cur);
 
@@ -3199,7 +3206,7 @@ static int responseRilSignalStrength(Parcel &p,
                 assert(0);
             }
         }
-        RIL_SignalStrength_v10 *p_cur = ((RIL_SignalStrength_v10 *) response);
+        p_cur = ((RIL_SignalStrength_v10 *) response);
         responseRilSignalStrengthV10(p, p_cur);
     }
     startResponse;
@@ -3978,8 +3985,8 @@ static int responseLceStatus(Parcel &p, void *response, size_t responselen) {
       RLOGE("invalid response: NULL");
     }
     else {
-      RLOGE("responseLceStatus: invalid response length %d expecting len: d%",
-            sizeof(RIL_LceStatusInfo), responselen);
+      RLOGE("responseLceStatus: invalid response length %u expecting len: %u",
+            (unsigned)sizeof(RIL_LceStatusInfo), (unsigned)responselen);
     }
     return RIL_ERRNO_INVALID_RESPONSE;
   }
@@ -4002,8 +4009,8 @@ static int responseLceData(Parcel &p, void *response, size_t responselen) {
       RLOGE("invalid response: NULL");
     }
     else {
-      RLOGE("responseLceData: invalid response length %d expecting len: d%",
-            sizeof(RIL_LceDataInfo), responselen);
+      RLOGE("responseLceData: invalid response length %u expecting len: %u",
+            (unsigned)sizeof(RIL_LceDataInfo), (unsigned)responselen);
     }
     return RIL_ERRNO_INVALID_RESPONSE;
   }
@@ -4031,8 +4038,8 @@ static int responseActivityData(Parcel &p, void *response, size_t responselen) {
       RLOGE("invalid response: NULL");
     }
     else {
-      RLOGE("responseActivityData: invalid response length %d expecting len: d%",
-            sizeof(RIL_ActivityStatsInfo), responselen);
+      RLOGE("responseActivityData: invalid response length %u expecting len: %u",
+            (unsigned)sizeof(RIL_ActivityStatsInfo), (unsigned)responselen);
     }
     return RIL_ERRNO_INVALID_RESPONSE;
   }
@@ -4062,32 +4069,67 @@ static int responseCarrierRestrictions(Parcel &p, void *response, size_t respons
     return RIL_ERRNO_INVALID_RESPONSE;
   }
   if (responselen != sizeof(RIL_CarrierRestrictions)) {
-    RLOGE("responseCarrierRestrictions: invalid response length %d expecting len: %d",
-          sizeof(RIL_CarrierRestrictions), responselen);
+    RLOGE("responseCarrierRestrictions: invalid response length %u expecting len: %u",
+          (unsigned)responselen, (unsigned)sizeof(RIL_CarrierRestrictions));
     return RIL_ERRNO_INVALID_RESPONSE;
   }
 
   RIL_CarrierRestrictions *p_cr = (RIL_CarrierRestrictions *)response;
-  p.writeUint32(p_cr->len_allowed_carriers);
-  p.writeUint32(p_cr->len_excluded_carriers);
-  for(uint_t i = 0; i < p_cr->len_allowed_carriers; i++) {
+  startResponse;
+
+  p.writeInt32(p_cr->len_allowed_carriers);
+  p.writeInt32(p_cr->len_excluded_carriers);
+  appendPrintBuf(" %s len_allowed_carriers: %d, len_excluded_carriers: %d,", printBuf,
+                 p_cr->len_allowed_carriers,p_cr->len_excluded_carriers);
+
+  appendPrintBuf(" %s allowed_carriers:", printBuf);
+  for(int32_t i = 0; i < p_cr->len_allowed_carriers; i++) {
     RIL_Carrier *carrier = p_cr->allowed_carriers + i;
-    p.writeCString(carrier->mcc);
-    p.writeCString(carrier->mnc);
+    writeStringToParcel(p, carrier->mcc);
+    writeStringToParcel(p, carrier->mnc);
     p.writeInt32(carrier->match_type);
-    p.writeCString(carrier->match_data);
+    writeStringToParcel(p, carrier->match_data);
+    appendPrintBuf(" %s [%d mcc: %s, mnc: %s, match_type: %d, match_data: %s],", printBuf,
+                   i, carrier->mcc, carrier->mnc, carrier->match_type, carrier->match_data);
   }
-  for(uint_t i = 0; i < p_cr->len_excluded_carriers; i++) {
+
+  appendPrintBuf(" %s excluded_carriers:", printBuf);
+  for(int32_t i = 0; i < p_cr->len_excluded_carriers; i++) {
     RIL_Carrier *carrier = p_cr->excluded_carriers + i;
-    p.writeCString(carrier->mcc);
-    p.writeCString(carrier->mnc);
+    writeStringToParcel(p, carrier->mcc);
+    writeStringToParcel(p, carrier->mnc);
     p.writeInt32(carrier->match_type);
-    p.writeCString(carrier->match_data);
+    writeStringToParcel(p, carrier->match_data);
+    appendPrintBuf(" %s [%d mcc: %s, mnc: %s, match_type: %d, match_data: %s],", printBuf,
+                   i, carrier->mcc, carrier->mnc, carrier->match_type, carrier->match_data);
+  }
+
+  closeResponse;
+
+  return 0;
+}
+
+static int responsePcoData(Parcel &p, void *response, size_t responselen) {
+  if (response == NULL) {
+    RLOGE("responsePcoData: invalid NULL response");
+    return RIL_ERRNO_INVALID_RESPONSE;
   }
+  if (responselen != sizeof(RIL_PCO_Data)) {
+    RLOGE("responsePcoData: invalid response length %u, expecting %u",
+          (unsigned)responselen, (unsigned)sizeof(RIL_PCO_Data));
+    return RIL_ERRNO_INVALID_RESPONSE;
+  }
+
+  RIL_PCO_Data *p_cur = (RIL_PCO_Data *)response;
+  p.writeInt32(p_cur->cid);
+  writeStringToParcel(p, p_cur->bearer_proto);
+  p.writeInt32(p_cur->pco_id);
+  p.writeInt32(p_cur->contents_length);
+  p.write(p_cur->contents, p_cur->contents_length);
 
   startResponse;
-  appendPrintBuf("CarrierRestrictions received: len_allowed_carriers %d len_excluded_carriers %d",
-                  p_cr->len_allowed_carriers,p_cr->len_excluded_carriers);
+      appendPrintBuf("PCO data received: cid %d, id %d, length %d",
+                     p_cur->cid, p_cur->pco_id, p_cur->contents_length);
   closeResponse;
 
   return 0;
@@ -4239,7 +4281,7 @@ static void listenCallback (int fd, short flags, void *param) {
     int err;
     int is_phone_socket;
     int fdCommand = -1;
-    char* processName;
+    const char* processName;
     RecordStream *p_rs;
     MySocketListenParam* listenParam;
     RilSocket *sapSocket = NULL;
@@ -4377,12 +4419,12 @@ static void debugCallback (int fd, short flags, void *param) {
     int data;
     unsigned int qxdm_data[6];
     const char *deactData[1] = {"1"};
-    char *actData[1];
     RIL_Dial dialData;
     int hangupData[1] = {1};
     int number;
     char **args;
     RIL_SOCKET_ID socket_id = RIL_SOCKET_1;
+    int MAX_DIAL_ADDRESS = 128;
     int sim_id = 0;
 
     RLOGI("debugCallback for socket %s", rilSocketIdToString(socket_id));
@@ -4529,12 +4571,6 @@ static void debugCallback (int fd, short flags, void *param) {
             // Set network selection automatic.
             issueLocalRequest(RIL_REQUEST_SET_NETWORK_SELECTION_AUTOMATIC, NULL, 0, socket_id);
             break;
-        case 6:
-            RLOGI("Debug port: Setup Data Call, Apn :%s\n", args[1]);
-            actData[0] = args[1];
-            issueLocalRequest(RIL_REQUEST_SETUP_DATA_CALL, &actData,
-                              sizeof(actData), socket_id);
-            break;
         case 7:
             RLOGI("Debug port: Deactivate Data Call");
             issueLocalRequest(RIL_REQUEST_DEACTIVATE_DATA_CALL, &deactData,
@@ -4543,6 +4579,12 @@ static void debugCallback (int fd, short flags, void *param) {
         case 8:
             RLOGI("Debug port: Dial Call");
             dialData.clir = 0;
+            if (strlen(args[1]) > MAX_DIAL_ADDRESS) {
+                RLOGE("Debug port: Error calling Dial");
+                freeDebugCallbackArgs(number, args);
+                close(acceptFD);
+                return;
+            }
             dialData.address = args[1];
             issueLocalRequest(RIL_REQUEST_DIAL, &dialData, sizeof(dialData), socket_id);
             break;
@@ -4741,7 +4783,8 @@ RIL_register (const RIL_RadioFunctions *callbacks) {
                         &s_commands_event,        /* commands_event */
                         &s_listen_event,          /* listen_event */
                         processCommandsCallback,  /* processCommandsCallback */
-                        NULL                      /* p_rs */
+                        NULL,                     /* p_rs */
+                        RIL_TELEPHONY_SOCKET      /* type */
                         };
 
 #if (SIM_COUNT >= 2)
@@ -4753,7 +4796,8 @@ RIL_register (const RIL_RadioFunctions *callbacks) {
                         &s_commands_event_socket2,  /* commands_event */
                         &s_listen_event_socket2,    /* listen_event */
                         processCommandsCallback,    /* processCommandsCallback */
-                        NULL                        /* p_rs */
+                        NULL,                       /* p_rs */
+                        RIL_TELEPHONY_SOCKET        /* type */
                         };
 #endif
 
@@ -4766,7 +4810,8 @@ RIL_register (const RIL_RadioFunctions *callbacks) {
                         &s_commands_event_socket3,  /* commands_event */
                         &s_listen_event_socket3,    /* listen_event */
                         processCommandsCallback,    /* processCommandsCallback */
-                        NULL                        /* p_rs */
+                        NULL,                       /* p_rs */
+                        RIL_TELEPHONY_SOCKET        /* type */
                         };
 #endif
 
@@ -4779,7 +4824,8 @@ RIL_register (const RIL_RadioFunctions *callbacks) {
                         &s_commands_event_socket4,  /* commands_event */
                         &s_listen_event_socket4,    /* listen_event */
                         processCommandsCallback,    /* processCommandsCallback */
-                        NULL                        /* p_rs */
+                        NULL,                       /* p_rs */
+                        RIL_TELEPHONY_SOCKET        /* type */
                         };
 #endif
 
@@ -4882,6 +4928,8 @@ RIL_register_socket (RIL_RadioFunctions *(*Init)(const struct RIL_Env *, int, ch
 #if (SIM_COUNT >= 4)
                 RilSapSocket::initSapSocket("sap_uim_socket4", UimFuncs);
 #endif
+                break;
+            default:;
         }
     }
 }
@@ -5768,6 +5816,7 @@ requestToString(int request) {
         case RIL_REQUEST_SHUTDOWN: return "SHUTDOWN";
         case RIL_UNSOL_RADIO_CAPABILITY: return "RIL_UNSOL_RADIO_CAPABILITY";
         case RIL_RESPONSE_ACKNOWLEDGEMENT: return "RIL_RESPONSE_ACKNOWLEDGEMENT";
+        case RIL_UNSOL_PCO_DATA: return "RIL_UNSOL_PCO_DATA";
         default: return "<unknown request>";
     }
 }