From 2e7e15f2da527f762f6eb56b974e758d83f12660 Mon Sep 17 00:00:00 2001
From: John Huang <nobody@android.com>
Date: Wed, 1 Jul 2009 10:08:20 -0700
Subject: [PATCH] AI 150264: DO NOT MERGE TO DONUT.   Manual merge of
 https://android-git.corp.google.com/g/Gerrit#change,5804 from donut:   Ensure
 that we never trigger ArrayIndexOutOfBoundsException by checking that   the
 index is always < the array's length. Also ensures that the object's   state
 is consistent. Should resolve a denial-of-service bug when handling  
 malformed WAP pushes.   Also add a try-catch around call to
 dispatchMessage(), in case there are other lurking bugs.  (This is also
 already in Donut.)

Automated import of CL 150264
---
 .../internal/telephony/WspTypeDecoder.java    | 28 ++++++++++++-------
 .../internal/telephony/gsm/SMSDispatcher.java |  6 +++-
 2 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/telephony/java/com/android/internal/telephony/WspTypeDecoder.java b/telephony/java/com/android/internal/telephony/WspTypeDecoder.java
index 2984fa8a576cd..3bbe0e17a86e3 100644
--- a/telephony/java/com/android/internal/telephony/WspTypeDecoder.java
+++ b/telephony/java/com/android/internal/telephony/WspTypeDecoder.java
@@ -187,22 +187,30 @@ public class WspTypeDecoder {
     }
 
     /**
-     * Decode the "Extension-media" type for WSP pdu
-     *
-     * @param startIndex The starting position of the "Extension-media" in this pdu
-     *
-     * @return false when error(not a Extension-media) occur
-     *         return value can be retrieved by getValueString() method
-     *         length of data in pdu can be retrieved by getValue32() method
-     */
+    * Decode the "Extension-media" type for WSP PDU.
+    *
+    * @param startIndex The starting position of the "Extension-media" in this PDU.
+    *
+    * @return false on error, such as if there is no Extension-media at startIndex.
+    * Side-effects: updates stringValue (available with getValueString()), which will be
+    * null on error. The length of the data in the PDU is available with getValue32(), 0
+    * on error.
+    */
     public boolean decodeExtensionMedia(int startIndex) {
         int index = startIndex;
-        while (wspData[index] != 0) {
+        dataLength = 0;
+        stringValue = null;
+        int length = wspData.length;
+        boolean rtrn = index < length;
+
+        while (index < length && wspData[index] != 0) {
             index++;
         }
+
         dataLength  = index - startIndex + 1;
         stringValue = new String(wspData, startIndex, dataLength - 1);
-        return true;
+
+        return rtrn;
     }
 
     /**
diff --git a/telephony/java/com/android/internal/telephony/gsm/SMSDispatcher.java b/telephony/java/com/android/internal/telephony/gsm/SMSDispatcher.java
index 558552409b253..f4450298ca88a 100644
--- a/telephony/java/com/android/internal/telephony/gsm/SMSDispatcher.java
+++ b/telephony/java/com/android/internal/telephony/gsm/SMSDispatcher.java
@@ -254,7 +254,11 @@ final class SMSDispatcher extends Handler {
             }
 
             sms = (SmsMessage) ar.result;
-            dispatchMessage(sms);
+            try {
+                dispatchMessage(sms);
+            } catch (RuntimeException ex) {
+                Log.e(TAG, "Exception processing incoming SMS. Exception:" + ex);
+            }
 
             break;