Skip to content

Commit de442a2

Browse files
lcolittitemasek
authored andcommitted
Don't crash if we get a DHCP packet with the wrong port.
This should only happen if we get a packet in the small time window between binding the packet socket and programming the BPF filter on it. Bug: 26696823 Change-Id: I481f1bc74bbaeb9646d96e1841d2a69acdb47d62
1 parent 080c2b4 commit de442a2

File tree

2 files changed

+38
-1
lines changed

2 files changed

+38
-1
lines changed

services/net/java/android/net/dhcp/DhcpPacket.java

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -804,7 +804,11 @@ public static DhcpPacket decodeFullPacket(ByteBuffer packet, int pktType) throws
804804
// server-to-server packets, e.g. for relays.
805805
if (!isPacketToOrFromClient(udpSrcPort, udpDstPort) &&
806806
!isPacketServerToServer(udpSrcPort, udpDstPort)) {
807-
return null;
807+
// This should almost never happen because we use SO_ATTACH_FILTER on the packet
808+
// socket to drop packets that don't have the right source ports. However, it's
809+
// possible that a packet arrives between when the socket is bound and when the
810+
// filter is set. http://b/26696823 .
811+
throw new ParseException("Unexpected UDP ports %d->%d", udpSrcPort, udpDstPort);
808812
}
809813
}
810814

services/tests/servicestests/src/android/net/dhcp/DhcpPacketTest.java

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -551,6 +551,39 @@ public void testUdpServerAnySourcePort() throws Exception {
551551
"wvm.edu", "10.1.105.252", null, 86400, false, dhcpResults);
552552
}
553553

554+
@SmallTest
555+
public void testUdpInvalidDstPort() throws Exception {
556+
final ByteBuffer packet = ByteBuffer.wrap(HexEncoding.decode((
557+
// Ethernet header.
558+
"9cd917000000001c2e0000000800" +
559+
// IP header.
560+
"45a00148000040003d115087d18194fb0a0f7af2" +
561+
// UDP header. TODO: fix invalid checksum (due to MAC address obfuscation).
562+
// NOTE: The destination port is a non-DHCP port.
563+
"0043aaaa01341268" +
564+
// BOOTP header.
565+
"02010600d628ba8200000000000000000a0f7af2000000000a0fc818" +
566+
// MAC address.
567+
"9cd91700000000000000000000000000" +
568+
// Server name.
569+
"0000000000000000000000000000000000000000000000000000000000000000" +
570+
"0000000000000000000000000000000000000000000000000000000000000000" +
571+
// File.
572+
"0000000000000000000000000000000000000000000000000000000000000000" +
573+
"0000000000000000000000000000000000000000000000000000000000000000" +
574+
"0000000000000000000000000000000000000000000000000000000000000000" +
575+
"0000000000000000000000000000000000000000000000000000000000000000" +
576+
// Options.
577+
"6382536335010236040a0169fc3304000151800104ffff000003040a0fc817060cd1818003d1819403" +
578+
"d18180060f0777766d2e6564751c040a0fffffff000000"
579+
).toCharArray(), false));
580+
581+
try {
582+
DhcpPacket.decodeFullPacket(packet, ENCAP_L2);
583+
fail("Packet with invalid dst port did not throw ParseException");
584+
} catch (ParseException expected) {}
585+
}
586+
554587
@SmallTest
555588
public void testMultipleRouters() throws Exception {
556589
final ByteBuffer packet = ByteBuffer.wrap(HexEncoding.decode((

0 commit comments

Comments
 (0)