NativeUtil: Perform range checks on ssid bytes size
NativeUtil.encodeSsid/decodeSsid should perform range checks because the
output/input is coming from binder/hwbinder interfaces which assume
the ssid is not malformed (i.e within spec mandated size range).
Most of the callers of these methods already handle
IllegalArgumentException (including the hidden network list built in
WifiCondControl). This should fix the reported issue of a hidden SSID
added with size > 32 causing crash in wificond.
Bug: 130843221
Test: Device boots up & connects to wifi networks.
Test: Regression tests.
Test: atest com.android.server.wifi
Change-Id: I12d8f3b548a65005932bd8bc1c74de37769b0ee8
diff --git a/service/java/com/android/server/wifi/WifiVendorHal.java b/service/java/com/android/server/wifi/WifiVendorHal.java
index 4b6a349..8023bff 100644
--- a/service/java/com/android/server/wifi/WifiVendorHal.java
+++ b/service/java/com/android/server/wifi/WifiVendorHal.java
@@ -2233,9 +2233,6 @@
for (String ssidStr : config.whitelistSsids) {
byte[] ssid = NativeUtil.byteArrayFromArrayList(
NativeUtil.decodeSsid(ssidStr));
- if (ssid.length > 32) {
- throw new IllegalArgumentException("configureRoaming: ssid too long");
- }
roamingConfig.ssidWhitelist.add(ssid);
}
}
diff --git a/service/java/com/android/server/wifi/util/NativeUtil.java b/service/java/com/android/server/wifi/util/NativeUtil.java
index 2329d2e..d904399 100644
--- a/service/java/com/android/server/wifi/util/NativeUtil.java
+++ b/service/java/com/android/server/wifi/util/NativeUtil.java
@@ -42,6 +42,7 @@
private static final int MAC_LENGTH = 6;
private static final int MAC_OUI_LENGTH = 3;
private static final int MAC_STR_LENGTH = MAC_LENGTH * 2 + 5;
+ private static final int SSID_BYTES_MAX_LEN = 32;
/**
* Convert the string to byte array list.
@@ -272,7 +273,11 @@
* @throws IllegalArgumentException for null string.
*/
public static ArrayList<Byte> decodeSsid(String ssidStr) {
- return hexOrQuotedStringToBytes(ssidStr);
+ ArrayList<Byte> ssidBytes = hexOrQuotedStringToBytes(ssidStr);
+ if (ssidBytes.size() > SSID_BYTES_MAX_LEN) {
+ throw new IllegalArgumentException("ssid bytes size out of range: " + ssidBytes.size());
+ }
+ return ssidBytes;
}
/**
@@ -286,6 +291,9 @@
* @throws IllegalArgumentException for null bytes.
*/
public static String encodeSsid(ArrayList<Byte> ssidBytes) {
+ if (ssidBytes.size() > SSID_BYTES_MAX_LEN) {
+ throw new IllegalArgumentException("ssid bytes size out of range: " + ssidBytes.size());
+ }
return bytesToHexOrQuotedString(ssidBytes);
}
diff --git a/tests/wifitests/src/com/android/server/wifi/util/NativeUtilTest.java b/tests/wifitests/src/com/android/server/wifi/util/NativeUtilTest.java
index 79dcccf..d4bcb47 100644
--- a/tests/wifitests/src/com/android/server/wifi/util/NativeUtilTest.java
+++ b/tests/wifitests/src/com/android/server/wifi/util/NativeUtilTest.java
@@ -128,6 +128,18 @@
}
/**
+ * Test that conversion of SSID string with len > 32 to bytes fail.
+ */
+ @Test
+ public void testLargeSsidDecodeFails() throws Exception {
+ try {
+ NativeUtil.decodeSsid("\"asdrewqdfgyuiopldsqwertyuiolhdergcv\"");
+ fail("Expected ssid decode to fail");
+ } catch (IllegalArgumentException e) {
+ }
+ }
+
+ /**
* Test that conversion of ssid bytes to hex string ssid works.
*/
@Test
@@ -178,6 +190,25 @@
}
/**
+ * Test that conversion of SSID bytes with len > 32 to string fail.
+ */
+ @Test
+ public void testLargeSsidEncodeFails() throws Exception {
+ try {
+ NativeUtil.encodeSsid(new ArrayList<>(
+ Arrays.asList((byte) 0xf5, (byte) 0xe4, (byte) 0xab, (byte) 0x78, (byte) 0x78,
+ (byte) 0xab, (byte) 0x34, (byte) 0x32, (byte) 0x43, (byte) 0x9a,
+ (byte) 0xab, (byte) 0x34, (byte) 0x32, (byte) 0x43, (byte) 0x9a,
+ (byte) 0xab, (byte) 0x34, (byte) 0x32, (byte) 0x43, (byte) 0x9a,
+ (byte) 0xab, (byte) 0x34, (byte) 0x32, (byte) 0x43, (byte) 0x9a,
+ (byte) 0xab, (byte) 0x34, (byte) 0x32, (byte) 0x43, (byte) 0x9a,
+ (byte) 0xab, (byte) 0x34, (byte) 0x32, (byte) 0x43, (byte) 0x9a)));
+ fail("Expected ssid encode to fail");
+ } catch (IllegalArgumentException e) {
+ }
+ }
+
+ /**
* Test that parsing of quoted SSID to byte array and vice versa works.
*/
@Test
