diff options
author | Android (Google) Code Review <android-gerrit@google.com> | 2009-05-26 10:11:29 -0700 |
---|---|---|
committer | The Android Open Source Project <initial-contribution@android.com> | 2009-05-26 10:11:29 -0700 |
commit | 2c0858a4815a0eb3877595cc562564d34713939b (patch) | |
tree | 74477455dcf2e6d0530483f842956dac780e5232 /telephony | |
parent | 3246c224d5860b78e1c7264906dbcecca415da9d (diff) | |
parent | 511a0134e1bfe90a23960eea72eca565e52aa816 (diff) | |
download | frameworks_base-2c0858a4815a0eb3877595cc562564d34713939b.zip frameworks_base-2c0858a4815a0eb3877595cc562564d34713939b.tar.gz frameworks_base-2c0858a4815a0eb3877595cc562564d34713939b.tar.bz2 |
am 511a0134: Merge change 2302 into donut
Merge commit '511a0134e1bfe90a23960eea72eca565e52aa816'
* commit '511a0134e1bfe90a23960eea72eca565e52aa816':
added SmsMessage ConcatRef parsing validation
Diffstat (limited to 'telephony')
-rw-r--r-- | telephony/java/com/android/internal/telephony/SmsHeader.java | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/telephony/java/com/android/internal/telephony/SmsHeader.java b/telephony/java/com/android/internal/telephony/SmsHeader.java index d220648..7872eec 100644 --- a/telephony/java/com/android/internal/telephony/SmsHeader.java +++ b/telephony/java/com/android/internal/telephony/SmsHeader.java @@ -111,7 +111,10 @@ public class SmsHeader { /** * NOTE: as defined in the spec, ConcatRef and PortAddr * fields should not reoccur, but if they do the last - * occurrence is to be used. + * occurrence is to be used. Also, for ConcatRef + * elements, if the count is zero, sequence is zero, or + * sequence is larger than count, the entire element is to + * be ignored. */ int id = inStream.read(); int length = inStream.read(); @@ -124,7 +127,10 @@ public class SmsHeader { concatRef.msgCount = inStream.read(); concatRef.seqNumber = inStream.read(); concatRef.isEightBits = true; - smsHeader.concatRef = concatRef; + if (concatRef.msgCount != 0 && concatRef.seqNumber != 0 && + concatRef.seqNumber <= concatRef.msgCount) { + smsHeader.concatRef = concatRef; + } break; case ELT_ID_CONCATENATED_16_BIT_REFERENCE: concatRef = new ConcatRef(); @@ -132,7 +138,10 @@ public class SmsHeader { concatRef.msgCount = inStream.read(); concatRef.seqNumber = inStream.read(); concatRef.isEightBits = false; - smsHeader.concatRef = concatRef; + if (concatRef.msgCount != 0 && concatRef.seqNumber != 0 && + concatRef.seqNumber <= concatRef.msgCount) { + smsHeader.concatRef = concatRef; + } break; case ELT_ID_APPLICATION_PORT_ADDRESSING_8_BIT: portAddrs = new PortAddrs(); |