commit ff33b0cc4d4457a0bf8b25e5c2b4726ad6df5d1d
author Kyunglyul Hyun <klhyun@google.com> Tue Jul 02 16:47:58 2024 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Tue Jul 02 16:47:58 2024 +0000
tree 3c56cc4883f187c8d6775be4308e64de3272670d
parent 13669d09b38c7f0aa0cc409427bfac7466fb05dd
parent a53702a4d32ec45e33671865cd8a0ab313537be0

Fix handling invalid header length am: 6444ca61c2 am: a53702a4d3

Original change: https://android-review.googlesource.com/c/platform/external/obex/+/3152137

Change-Id: I63849bb1338cca2651a8cabdb462deece028d2be
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

src/com/android/obex/ObexHelper.java

diff --git a/src/com/android/obex/ObexHelper.java b/src/com/android/obex/ObexHelper.java
index e00ed75..5b61cd0 100644
--- a/src/com/android/obex/ObexHelper.java
+++ b/src/com/android/obex/ObexHelper.java
@@ -211,12 +211,23 @@
                         length = ((0xFF & headerArray[index]) << 8) +
                                  (0xFF & headerArray[index + 1]);
                         index += 2;
-                        if (length <= OBEX_BYTE_SEQ_HEADER_LEN ||
-                                length - OBEX_BYTE_SEQ_HEADER_LEN > headerArray.length - index) {
+
+                        // An empty Name header
+                        if (headerID == HeaderSet.NAME && length == OBEX_BYTE_SEQ_HEADER_LEN) {
+                            headerImpl.setEmptyNameHeader();
+                            continue;
+                        }
+
+                        if (length <= OBEX_BYTE_SEQ_HEADER_LEN) {
                             Log.e(TAG, "Remote sent an OBEX packet with " +
                                     "incorrect header length = " + length);
                             break;
                         }
+                        if (length - OBEX_BYTE_SEQ_HEADER_LEN > headerArray.length - index) {
+                            Log.e(TAG, "Remote sent an OBEX packet with " +
+                                    "incorrect header length = " + length);
+                            throw new IOException("Incorrect header length");
+                        }
                         length -= OBEX_BYTE_SEQ_HEADER_LEN;
                         value = new byte[length];
                         System.arraycopy(headerArray, index, value, 0, length);