Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

wifi: Fix StringIndexOutOfBoundsException for incorrectly encoded SSIDs

If the last character of a SSID is a unescaped backslash then WifiSsid
convertToBytes() will throw a StringIndexOutOfBoundsException and takes the
whole ROM down.

The issue was reported by andreip in the HTC One X XDA thread. His SSID was
set to "/ Andrew \".

04-10 21:33:54.265 E/AndroidRuntime(10479): *** FATAL EXCEPTION IN SYSTEM PROCESS: WifiStateMachine
04-10 21:33:54.265 E/AndroidRuntime(10479): java.lang.StringIndexOutOfBoundsException: length=10; index=10
04-10 21:33:54.265 E/AndroidRuntime(10479):     at android.net.wifi.WifiSsid.convertToBytes(WifiSsid.java:89)
04-10 21:33:54.265 E/AndroidRuntime(10479):     at android.net.wifi.WifiSsid.createFromAsciiEncoded(WifiSsid.java:54)
04-10 21:33:54.265 E/AndroidRuntime(10479):     at android.net.wifi.WifiStateMachine.setScanResults(WifiStateMachine.java:1522)
04-10 21:33:54.265 E/AndroidRuntime(10479):     at android.net.wifi.WifiStateMachine.access$7100(WifiStateMachine.java:103)
04-10 21:33:54.265 E/AndroidRuntime(10479):     at android.net.wifi.WifiStateMachine$SupplicantStartedState.processMessage(WifiStateMachine.java:2511)
04-10 21:33:54.265 E/AndroidRuntime(10479):     at com.android.internal.util.StateMachine$SmHandler.processMsg(StateMachine.java:905)
04-10 21:33:54.265 E/AndroidRuntime(10479):     at com.android.internal.util.StateMachine$SmHandler.handleMessage(StateMachine.java:760)
04-10 21:33:54.265 E/AndroidRuntime(10479):     at android.os.Handler.dispatchMessage(Handler.java:99)
04-10 21:33:54.265 E/AndroidRuntime(10479):     at android.os.Looper.loop(Looper.java:137)
04-10 21:33:54.265 E/AndroidRuntime(10479):     at android.os.HandlerThread.run(HandlerThread.java:60)

Change-Id: I8273decacfffea4e4cae3bb957c925833dab09e2
  • Loading branch information...
commit a954774db18b02f6bcb837da615d74483b7416bb 1 parent d8dc80a
@thoemy thoemy authored Gerrit Code Review committed
Showing with 5 additions and 0 deletions.
  1. +5 −0 wifi/java/android/net/wifi/WifiSsid.java
View
5 wifi/java/android/net/wifi/WifiSsid.java
@@ -86,6 +86,11 @@ private void convertToBytes(String asciiEncoded) {
switch (c) {
case '\\':
i++;
+ if (i >= asciiEncoded.length()) {
+ octets.write('\\');
+ break;
+ }
+
switch(asciiEncoded.charAt(i)) {
case '\\':
octets.write('\\');
Please sign in to comment.
Something went wrong with that request. Please try again.