TelephonyUtil: Verify that all length values parsed are > 0

Bug: 129867406
Test: atest com.android.server.wifi
Change-Id: Ie161a070fe4d7447bc38e5612040e4c6a6299222

1 files changed, 2 insertions, 2 deletions

diff --git a/service/java/com/android/server/wifi/util/TelephonyUtil.java b/service/java/com/android/server/wifi/util/TelephonyUtil.java
index 56929406d..873fda528 100644
--- a/service/java/com/android/server/wifi/util/TelephonyUtil.java
+++ b/service/java/com/android/server/wifi/util/TelephonyUtil.java
@@ -485,7 +485,7 @@ public class TelephonyUtil {
             byte[] result = Base64.decode(tmResponse, Base64.DEFAULT);
             Log.v(TAG, "Hex Response -" + makeHex(result));
             int sresLen = result[0];
-            if (sresLen >= result.length) {
+            if (sresLen < 0 || sresLen >= result.length) {
                 Log.e(TAG, "malformed response - " + tmResponse);
                 return null;
             }
@@ -496,7 +496,7 @@ public class TelephonyUtil {
                 return null;
             }
             int kcLen = result[kcOffset];
-            if (kcOffset + kcLen > result.length) {
+            if (kcLen < 0 || kcOffset + kcLen > result.length) {
                 Log.e(TAG, "malformed response - " + tmResponse);
                 return null;
             }