diff --git a/libril/ril_service.cpp b/libril/ril_service.cpp index d91f9cd..495c3e0 100644 --- a/libril/ril_service.cpp +++ b/libril/ril_service.cpp @@ -2986,7 +2986,7 @@ int responseIntOrEmpty(RadioResponseInfo& responseInfo, int serial, int response // Earlier RILs did not send a response for some cases although the interface // expected an integer as response. Do not return error if response is empty. Instead // Return -1 in those cases to maintain backward compatibility. - } else if (response == NULL || responseLen != sizeof(int)) { + } else if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("responseIntOrEmpty: Invalid response"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; } else { @@ -3001,7 +3001,7 @@ int responseInt(RadioResponseInfo& responseInfo, int serial, int responseType, R populateResponseInfo(responseInfo, serial, responseType, e); int ret = -1; - if (response == NULL || responseLen != sizeof(int)) { + if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("responseInt: Invalid response"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; } else { @@ -3450,13 +3450,13 @@ int radio::getLastCallFailCauseResponse(int slotId, if (response == NULL) { RLOGE("getCurrentCallsResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; - } else if (responseLen == sizeof(int)) { - int *pInt = (int *) response; - info.causeCode = (LastCallFailCause) pInt[0]; } else if (responseLen == sizeof(RIL_LastCallFailCauseInfo)) { RIL_LastCallFailCauseInfo *pFailCauseInfo = (RIL_LastCallFailCauseInfo *) response; info.causeCode = (LastCallFailCause) pFailCauseInfo->cause_code; info.vendorCause = convertCharPtrToHidlString(pFailCauseInfo->vendor_cause); + } else if (responseLen % sizeof(int) != 0) { + int *pInt = (int *) response; + info.causeCode = (LastCallFailCause) pInt[0]; } else { RLOGE("getCurrentCallsResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; @@ -3809,7 +3809,7 @@ int radio::getVoiceRegistrationStateResponse(int slotId, RLOGE("getVoiceRegistrationStateResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; } else if (s_vendorFunctions->version <= 14) { - if (numStrings != 15) { + if (numStrings < 15) { RLOGE("getVoiceRegistrationStateResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; } else { @@ -3822,7 +3822,7 @@ int radio::getVoiceRegistrationStateResponse(int slotId, voiceRegResponse.defaultRoamingIndicator = ATOI_NULL_HANDLED_DEF(resp[12], 0); voiceRegResponse.reasonForDenial = ATOI_NULL_HANDLED_DEF(resp[13], 0); fillCellIdentityFromVoiceRegStateResponseString(voiceRegResponse.cellIdentity, - numStrings, resp); + 15, resp); } } else { RIL_VoiceRegistrationStateResponse *voiceRegState = @@ -3872,7 +3872,7 @@ int radio::getDataRegistrationStateResponse(int slotId, if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; } else if (s_vendorFunctions->version <= 14) { int numStrings = responseLen / sizeof(char *); - if ((numStrings != 6) && (numStrings != 11)) { + if (numStrings < 6) { RLOGE("getDataRegistrationStateResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; } else { @@ -3882,7 +3882,7 @@ int radio::getDataRegistrationStateResponse(int slotId, dataRegResponse.reasonDataDenied = ATOI_NULL_HANDLED(resp[4]); dataRegResponse.maxDataCalls = ATOI_NULL_HANDLED_DEF(resp[5], 1); fillCellIdentityFromDataRegStateResponseString(dataRegResponse.cellIdentity, - numStrings, resp); + numStrings < 11 ? 6 : 11, resp); } } else { RIL_DataRegistrationStateResponse *dataRegState = @@ -3926,7 +3926,7 @@ int radio::getOperatorResponse(int slotId, hidl_string shortName; hidl_string numeric; int numStrings = responseLen / sizeof(char *); - if (response == NULL || numStrings != 3) { + if (response == NULL || numStrings < 3) { RLOGE("getOperatorResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; @@ -4193,7 +4193,7 @@ int radio::getClirResponse(int slotId, populateResponseInfo(responseInfo, serial, responseType, e); int n = -1, m = -1; int numInts = responseLen / sizeof(int); - if (response == NULL || numInts != 2) { + if (response == NULL || numInts < 2) { RLOGE("getClirResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; } else { @@ -4305,7 +4305,7 @@ int radio::getCallWaitingResponse(int slotId, bool enable = false; int serviceClass = -1; int numInts = responseLen / sizeof(int); - if (response == NULL || numInts != 2) { + if (response == NULL || numInts < 2) { RLOGE("getCallWaitingResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; } else { @@ -4482,7 +4482,7 @@ int radio::getNetworkSelectionModeResponse(int slotId, RadioResponseInfo responseInfo = {}; populateResponseInfo(responseInfo, serial, responseType, e); bool manual = false; - if (response == NULL || responseLen != sizeof(int)) { + if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("getNetworkSelectionModeResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; } else { @@ -4573,7 +4573,7 @@ int radio::getAvailableNetworksResponse(int slotId, populateResponseInfo(responseInfo, serial, responseType, e); hidl_vec networks; if ((response == NULL && responseLen != 0) - || responseLen % (qanRespStrings * sizeof(char *))!= 0) { + || responseLen % (qanRespStrings * sizeof(char *)) != 0) { RLOGE("getAvailableNetworksResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; } else { @@ -4717,7 +4717,7 @@ int radio::getMuteResponse(int slotId, RadioResponseInfo responseInfo = {}; populateResponseInfo(responseInfo, serial, responseType, e); bool enable = false; - if (response == NULL || responseLen != sizeof(int)) { + if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("getMuteResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; } else { @@ -5234,7 +5234,7 @@ int radio::getPreferredVoicePrivacyResponse(int slotId, populateResponseInfo(responseInfo, serial, responseType, e); bool enable = false; int numInts = responseLen / sizeof(int); - if (response == NULL || numInts != 1) { + if (response == NULL || numInts < 1) { RLOGE("getPreferredVoicePrivacyResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; } else { @@ -5520,7 +5520,7 @@ int radio::getCDMASubscriptionResponse(int slotId, int numStrings = responseLen / sizeof(char *); hidl_string emptyString; - if (response == NULL || numStrings != 5) { + if (response == NULL || numStrings < 5) { RLOGE("getOperatorResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; Return retStatus @@ -5600,7 +5600,7 @@ int radio::getDeviceIdentityResponse(int slotId, int numStrings = responseLen / sizeof(char *); hidl_string emptyString; - if (response == NULL || numStrings != 4) { + if (response == NULL || numStrings < 4) { RLOGE("getDeviceIdentityResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; Return retStatus @@ -5931,7 +5931,7 @@ int radio::getImsRegistrationStateResponse(int slotId, bool isRegistered = false; int ratFamily = 0; int numInts = responseLen / sizeof(int); - if (response == NULL || numInts != 2) { + if (response == NULL || numInts < 2) { RLOGE("getImsRegistrationStateResponse Invalid response: NULL"); if (e == RIL_E_SUCCESS) responseInfo.error = RadioError::INVALID_RESPONSE; } else { @@ -6969,7 +6969,7 @@ int radio::newSmsStatusReportInd(int slotId, int radio::newSmsOnSimInd(int slotId, int indicationType, int token, RIL_Errno e, void *response, size_t responseLen) { if (radioService[slotId] != NULL && radioService[slotId]->mRadioIndication != NULL) { - if (response == NULL || responseLen != sizeof(int)) { + if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("newSmsOnSimInd: invalid response"); return 0; } @@ -6990,7 +6990,7 @@ int radio::newSmsOnSimInd(int slotId, int indicationType, int radio::onUssdInd(int slotId, int indicationType, int token, RIL_Errno e, void *response, size_t responseLen) { if (radioService[slotId] != NULL && radioService[slotId]->mRadioIndication != NULL) { - if (response == NULL || responseLen != 2 * sizeof(char *)) { + if (response == NULL || responseLen < 2 * sizeof(char *)) { RLOGE("onUssdInd: invalid response"); return 0; } @@ -7366,7 +7366,7 @@ int radio::stkEventNotifyInd(int slotId, int indicationType, int radio::stkCallSetupInd(int slotId, int indicationType, int token, RIL_Errno e, void *response, size_t responseLen) { if (radioService[slotId] != NULL && radioService[slotId]->mRadioIndication != NULL) { - if (response == NULL || responseLen != sizeof(int)) { + if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("stkCallSetupInd: invalid response"); return 0; } @@ -7577,7 +7577,7 @@ int radio::restrictedStateChangedInd(int slotId, int indicationType, int token, RIL_Errno e, void *response, size_t responseLen) { if (radioService[slotId] != NULL && radioService[slotId]->mRadioIndication != NULL) { - if (response == NULL || responseLen != sizeof(int)) { + if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("restrictedStateChangedInd: invalid response"); return 0; } @@ -7651,7 +7651,7 @@ int radio::cdmaOtaProvisionStatusInd(int slotId, int indicationType, int token, RIL_Errno e, void *response, size_t responseLen) { if (radioService[slotId] != NULL && radioService[slotId]->mRadioIndication != NULL) { - if (response == NULL || responseLen != sizeof(int)) { + if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("cdmaOtaProvisionStatusInd: invalid response"); return 0; } @@ -7864,7 +7864,7 @@ int radio::indicateRingbackToneInd(int slotId, int indicationType, int token, RIL_Errno e, void *response, size_t responseLen) { if (radioService[slotId] != NULL && radioService[slotId]->mRadioIndication != NULL) { - if (response == NULL || responseLen != sizeof(int)) { + if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("indicateRingbackToneInd: invalid response"); return 0; } @@ -7903,7 +7903,7 @@ int radio::cdmaSubscriptionSourceChangedInd(int slotId, int indicationType, int token, RIL_Errno e, void *response, size_t responseLen) { if (radioService[slotId] != NULL && radioService[slotId]->mRadioIndication != NULL) { - if (response == NULL || responseLen != sizeof(int)) { + if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("cdmaSubscriptionSourceChangedInd: invalid response"); return 0; } @@ -7927,7 +7927,7 @@ int radio::cdmaPrlChangedInd(int slotId, int indicationType, int token, RIL_Errno e, void *response, size_t responseLen) { if (radioService[slotId] != NULL && radioService[slotId]->mRadioIndication != NULL) { - if (response == NULL || responseLen != sizeof(int)) { + if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("cdmaPrlChangedInd: invalid response"); return 0; } @@ -7982,7 +7982,7 @@ int radio::voiceRadioTechChangedInd(int slotId, int indicationType, int token, RIL_Errno e, void *response, size_t responseLen) { if (radioService[slotId] != NULL && radioService[slotId]->mRadioIndication != NULL) { - if (response == NULL || responseLen != sizeof(int)) { + if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("voiceRadioTechChangedInd: invalid response"); return 0; } @@ -8193,7 +8193,7 @@ int radio::subscriptionStatusChangedInd(int slotId, int indicationType, int token, RIL_Errno e, void *response, size_t responseLen) { if (radioService[slotId] != NULL && radioService[slotId]->mRadioIndication != NULL) { - if (response == NULL || responseLen != sizeof(int)) { + if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("subscriptionStatusChangedInd: invalid response"); return 0; } @@ -8216,7 +8216,7 @@ int radio::srvccStateNotifyInd(int slotId, int indicationType, int token, RIL_Errno e, void *response, size_t responseLen) { if (radioService[slotId] != NULL && radioService[slotId]->mRadioIndication != NULL) { - if (response == NULL || responseLen != sizeof(int)) { + if (response == NULL || responseLen % sizeof(int) != 0) { RLOGE("srvccStateNotifyInd: invalid response"); return 0; }