NativeUtil: Perform range checks on ssid bytes size
NativeUtil.encodeSsid/decodeSsid should perform range checks because the
output/input is coming from binder/hwbinder interfaces which assume
the ssid is not malformed (i.e within spec mandated size range).
Most of the callers of these methods already handle
IllegalArgumentException (including the hidden network list built in
WifiCondControl). This should fix the reported issue of a hidden SSID
added with size > 32 causing crash in wificond.
Bug: 130843221
Test: Device boots up & connects to wifi networks.
Test: Regression tests.
Test: atest com.android.server.wifi
Change-Id: I12d8f3b548a65005932bd8bc1c74de37769b0ee8
diff --git a/service/java/com/android/server/wifi/util/NativeUtil.java b/service/java/com/android/server/wifi/util/NativeUtil.java
index 2329d2e..d904399 100644
--- a/service/java/com/android/server/wifi/util/NativeUtil.java
+++ b/service/java/com/android/server/wifi/util/NativeUtil.java
@@ -42,6 +42,7 @@
private static final int MAC_LENGTH = 6;
private static final int MAC_OUI_LENGTH = 3;
private static final int MAC_STR_LENGTH = MAC_LENGTH * 2 + 5;
+ private static final int SSID_BYTES_MAX_LEN = 32;
/**
* Convert the string to byte array list.
@@ -272,7 +273,11 @@
* @throws IllegalArgumentException for null string.
*/
public static ArrayList<Byte> decodeSsid(String ssidStr) {
- return hexOrQuotedStringToBytes(ssidStr);
+ ArrayList<Byte> ssidBytes = hexOrQuotedStringToBytes(ssidStr);
+ if (ssidBytes.size() > SSID_BYTES_MAX_LEN) {
+ throw new IllegalArgumentException("ssid bytes size out of range: " + ssidBytes.size());
+ }
+ return ssidBytes;
}
/**
@@ -286,6 +291,9 @@
* @throws IllegalArgumentException for null bytes.
*/
public static String encodeSsid(ArrayList<Byte> ssidBytes) {
+ if (ssidBytes.size() > SSID_BYTES_MAX_LEN) {
+ throw new IllegalArgumentException("ssid bytes size out of range: " + ssidBytes.size());
+ }
return bytesToHexOrQuotedString(ssidBytes);
}
