Android WAP Push SMS CVE-2026-58882

Izpostavljena ranljivost v Android telefonih zaradi integer overflow napake.

Popravek
https://android.googlesource.com/platfo...

RESTRICT AUTOMERGE: Fix remote DoS in decodeWapPdu (b/517376969)

Catch RuntimeException during WAP push PDU decoding and SMS broadcast
to prevent persistent crash loops. If decoding fails, log a warning and
delete the poison tracker from the raw database.
Also add warning logs if inboundSmsTracker is null during broadcast.
Added corresponding unit tests in WapPushOverSmsTest and GsmInboundSmsHandlerTest.

Bug: 517376969
Test: atest FrameworksTelephonyTests:WapPushOverSmsTest FrameworksTelephonyTests:GsmInboundSmsHandlerTest
Flag: EXEMPT CVE_FIX
(cherry picked from commit 618039539b4bd57c6761def72a567def95e3dfad)

Diff

diff --git a/src/java/com/android/internal/telephony/InboundSmsHandler.java b/src/java/com/android/internal/telephony/InboundSmsHandler.java
index 1bd4737..9ddee30 100644
--- a/src/java/com/android/internal/telephony/InboundSmsHandler.java
+++ b/src/java/com/android/internal/telephony/InboundSmsHandler.java
@@ -624,7 +624,19 @@
case EVENT_BROADCAST_SMS:
// if any broadcasts were sent, transition to waiting state
InboundSmsTracker inboundSmsTracker = (InboundSmsTracker) msg.obj;
- if (processMessagePart(inboundSmsTracker)) {
+ boolean success = false;
+ if (inboundSmsTracker != null) {
+ try {
+ success = processMessagePart(inboundSmsTracker);
+ } catch (RuntimeException e) {
+ loge("Exception delivering message part", e);
+ deleteFromRawTable(inboundSmsTracker.getDeleteWhere(),
+ inboundSmsTracker.getDeleteWhereArgs(), MARK_DELETED);
+ }
+ } else {
+ loge("EVENT_BROADCAST_SMS with null inboundSmsTracker");
+ }
+ if (success) {
sendMessage(obtainMessage(EVENT_UPDATE_TRACKER, msg.obj));
transitionTo(mWaitingState);
} else {
diff --git a/src/java/com/android/internal/telephony/WapPushOverSms.java b/src/java/com/android/internal/telephony/WapPushOverSms.java
index e03960a..ef692a9 100644
--- a/src/java/com/android/internal/telephony/WapPushOverSms.java
+++ b/src/java/com/android/internal/telephony/WapPushOverSms.java
@@ -314,10 +314,10 @@
result.intentData = intentData;
result.contentTypeParameters = pduDecoder.getContentParameters();
result.statusCode = Activity.RESULT_OK;
- } catch (ArrayIndexOutOfBoundsException aie) {
+ } catch (RuntimeException e) {
// 0-byte WAP PDU or other unexpected WAP PDU contents can easily throw this;
// log exception string without stack trace and return false.
- Rlog.e(TAG, "ignoring dispatchWapPdu() array index exception: " + aie);
+ Rlog.e(TAG, "ignoring decodeWapPdu() runtime exception: " + e);
result.statusCode = Intents.RESULT_SMS_GENERIC_ERROR;
}
return result;