From be3696759d6fdaa920c0bccd89320a4e95621edf Mon Sep 17 00:00:00 2001 From: Les Lee Date: Mon, 28 Jun 2021 18:03:18 +0800 Subject: [PATCH] fix: Invalid subscription plan cause NPE If someone setup a invalid subscription plan with subId:INVALID_SUBSCRIPTION_ID. (For instance, test code). It will cause NPE when WiFi connected because WiFi network doesn't own subscriberId. (Happened on API call: buildTemplateCarrierMetered with null subscriberId.) Fix: 1. Add null check before calling buildTemplateCarrierMetered 2. Add invalid subId check before saving subscription plan. Bug: 191938713 Test: atest -c NetworkPolicyManagerServiceTest Change-Id: I835a7b8890035975e187ca0a70ec2f30ca56455a --- .../server/net/NetworkPolicyManagerService.java | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/services/core/java/com/android/server/net/NetworkPolicyManagerService.java b/services/core/java/com/android/server/net/NetworkPolicyManagerService.java index 9fb5f04e1df68..0cf67073e7ce8 100644 --- a/services/core/java/com/android/server/net/NetworkPolicyManagerService.java +++ b/services/core/java/com/android/server/net/NetworkPolicyManagerService.java @@ -2139,6 +2139,7 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub { if (!quotaEnabled) continue; if (snapshot.getNetwork() == null) continue; final int subId = getSubIdLocked(snapshot.getNetwork()); + if (subId == INVALID_SUBSCRIPTION_ID) continue; final SubscriptionPlan plan = getPrimarySubscriptionPlanLocked(subId); if (plan == null) continue; @@ -2161,9 +2162,10 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub { final long startOfDay = ZonedDateTime.ofInstant(now, cycle.getLower().getZone()) .truncatedTo(ChronoUnit.DAYS) .toInstant().toEpochMilli(); - final long totalBytes = getTotalBytes( - buildTemplateCarrierMetered(snapshot.getSubscriberId()), - start, startOfDay); + final String subscriberId = snapshot.getSubscriberId(); + final long totalBytes = subscriberId == null + ? 0 : getTotalBytes( + buildTemplateCarrierMetered(subscriberId), start, startOfDay); final long remainingBytes = limitBytes - totalBytes; // Number of remaining days including current day final long remainingDays = @@ -2679,6 +2681,7 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub { // write all known subscription plans for (int i = 0; i < mSubscriptionPlans.size(); i++) { final int subId = mSubscriptionPlans.keyAt(i); + if (subId == INVALID_SUBSCRIPTION_ID) continue; final String ownerPackage = mSubscriptionPlansOwner.get(subId); final SubscriptionPlan[] plans = mSubscriptionPlans.valueAt(i); if (ArrayUtils.isEmpty(plans)) continue; @@ -5572,7 +5575,8 @@ public class NetworkPolicyManagerService extends INetworkPolicyManager.Stub { // Turn carrier/mobile data limit off NetworkPolicy[] policies = getNetworkPolicies(mContext.getOpPackageName()); - NetworkTemplate templateCarrier = buildTemplateCarrierMetered(subscriber); + NetworkTemplate templateCarrier = subscriber != null + ? buildTemplateCarrierMetered(subscriber) : null; NetworkTemplate templateMobile = buildTemplateMobileAll(subscriber); for (NetworkPolicy policy : policies) { // All policies loaded from disk will be carrier templates, and setting will also only