backport security fix: avoid set NITZ time to 2038
Bug: 29083635
Change-Id: I21c5f4147d8146f92b7e33f0967a179ae644a263
(cherry picked from commit 6c2365a258381ac0ecb34f143b620a32649d3d32)
diff --git a/src/java/com/android/internal/telephony/cdma/CdmaServiceStateTracker.java b/src/java/com/android/internal/telephony/cdma/CdmaServiceStateTracker.java
index e6b0867..85980e9 100644
--- a/src/java/com/android/internal/telephony/cdma/CdmaServiceStateTracker.java
+++ b/src/java/com/android/internal/telephony/cdma/CdmaServiceStateTracker.java
@@ -101,6 +101,8 @@
private static final int NITZ_UPDATE_DIFF_DEFAULT = 2000;
private int mNitzUpdateDiff = SystemProperties.getInt("ro.nitz_update_diff",
NITZ_UPDATE_DIFF_DEFAULT);
+ /** Time stamp after 19 January 2038 is not supported under 32 bit */
+ private static final int MAX_NITZ_YEAR = 2037;
private int mRoamingIndicator;
private boolean mIsInPrl;
@@ -1614,6 +1616,10 @@
String[] nitzSubs = nitz.split("[/:,+-]");
int year = 2000 + Integer.parseInt(nitzSubs[0]);
+ if (year > MAX_NITZ_YEAR) {
+ if (DBG) loge("NITZ year: " + year + " exceeds limit, skip NITZ time update");
+ return;
+ }
c.set(Calendar.YEAR, year);
// month is 0 based!
diff --git a/src/java/com/android/internal/telephony/gsm/GsmServiceStateTracker.java b/src/java/com/android/internal/telephony/gsm/GsmServiceStateTracker.java
index 8d3a84d..03fbd7f 100755
--- a/src/java/com/android/internal/telephony/gsm/GsmServiceStateTracker.java
+++ b/src/java/com/android/internal/telephony/gsm/GsmServiceStateTracker.java
@@ -136,6 +136,8 @@
/** Boolean is true is setTimeFromNITZString was called */
private boolean mNitzUpdatedTime = false;
+ /** Time stamp after 19 January 2038 is not supported under 32 bit */
+ private static final int MAX_NITZ_YEAR = 2037;
String mSavedTimeZone;
long mSavedTime;
@@ -1739,6 +1741,10 @@
String[] nitzSubs = nitz.split("[/:,+-]");
int year = 2000 + Integer.parseInt(nitzSubs[0]);
+ if (year > MAX_NITZ_YEAR) {
+ if (DBG) loge("NITZ year: " + year + " exceeds limit, skip NITZ time update");
+ return;
+ }
c.set(Calendar.YEAR, year);
// month is 0 based!
