commit 402dc021f7d80212fb7c3f9cb7349252e4ce4312
author Nathan Harold <nharold@google.com> Thu Jun 08 16:41:52 2017 -0700
committer Nathan Harold <nharold@google.com> Thu Jun 08 16:42:37 2017 -0700
tree 9c99c5cad95d5f4c6de02cb3fd93e3180071bf10
parent c2a8f44f115ae7d72cd866daedd1530e03b5808f

Add cross-validation to IccCardStatusResponse

Verify that the card app indices are within the range
of the number of provided apps.

Bug: 62459080
Test: none

Change-Id: I07a89b440ebfbe5a00a1b493527506a573b7d09a

libril/ril_service.cpp

diff --git a/libril/ril_service.cpp b/libril/ril_service.cpp
index cb4fb5c..61f21d8 100644
--- a/libril/ril_service.cpp
+++ b/libril/ril_service.cpp
@@ -2866,11 +2866,14 @@
         RadioResponseInfo responseInfo = {};
         populateResponseInfo(responseInfo, serial, responseType, e);
         CardStatus cardStatus = {};
-        if (response == NULL || responseLen != sizeof(RIL_CardStatus_v6)) {
+        RIL_CardStatus_v6 *p_cur = ((RIL_CardStatus_v6 *) response);
+        if (response == NULL || responseLen != sizeof(RIL_CardStatus_v6)
+                || p_cur->gsm_umts_subscription_app_index >= p_cur->num_applications
+                || p_cur->cdma_subscription_app_index >= p_cur->num_applications
+                || p_cur->ims_subscription_app_index >= p_cur->num_applications) {
             RLOGE("getIccCardStatusResponse: Invalid response");
             if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE;
         } else {
-            RIL_CardStatus_v6 *p_cur = ((RIL_CardStatus_v6 *) response);
             cardStatus.cardState = (CardState) p_cur->card_state;
             cardStatus.universalPinState = (PinState) p_cur->universal_pin_state;
             cardStatus.gsmUmtsSubscriptionAppIndex = p_cur->gsm_umts_subscription_app_index;