NativeUtil: Perform range checks on ssid bytes size

NativeUtil.encodeSsid/decodeSsid should perform range checks because the
output/input is coming from binder/hwbinder interfaces which assume
the ssid is not malformed (i.e within spec mandated size range).

Most of the callers of these methods already handle
IllegalArgumentException (including the hidden network list built in
WifiCondControl). This should fix the reported issue of a hidden SSID
added with size > 32 causing crash in wificond.

Bug: 130843221
Test: Device boots up & connects to wifi networks.
Test: Regression tests.
Test: atest com.android.server.wifi
Change-Id: I12d8f3b548a65005932bd8bc1c74de37769b0ee8

2 files changed, 9 insertions, 4 deletions

diff --git a/service/java/com/android/server/wifi/WifiVendorHal.java b/service/java/com/android/server/wifi/WifiVendorHal.java
index 4b6a3495e..8023bff49 100644
--- a/service/java/com/android/server/wifi/WifiVendorHal.java
+++ b/service/java/com/android/server/wifi/WifiVendorHal.java
@@ -2233,9 +2233,6 @@ public class WifiVendorHal {
                     for (String ssidStr : config.whitelistSsids) {
                         byte[] ssid = NativeUtil.byteArrayFromArrayList(
                                 NativeUtil.decodeSsid(ssidStr));
-                        if (ssid.length > 32) {
-                            throw new IllegalArgumentException("configureRoaming: ssid too long");
-                        }
                         roamingConfig.ssidWhitelist.add(ssid);
                     }
                 }
diff --git a/service/java/com/android/server/wifi/util/NativeUtil.java b/service/java/com/android/server/wifi/util/NativeUtil.java
index 2329d2e32..d904399a3 100644
--- a/service/java/com/android/server/wifi/util/NativeUtil.java
+++ b/service/java/com/android/server/wifi/util/NativeUtil.java
@@ -42,6 +42,7 @@ public class NativeUtil {
     private static final int MAC_LENGTH = 6;
     private static final int MAC_OUI_LENGTH = 3;
     private static final int MAC_STR_LENGTH = MAC_LENGTH * 2 + 5;
+    private static final int SSID_BYTES_MAX_LEN = 32;
 
     /**
      * Convert the string to byte array list.
@@ -272,7 +273,11 @@ public class NativeUtil {
      * @throws IllegalArgumentException for null string.
      */
     public static ArrayList<Byte> decodeSsid(String ssidStr) {
-        return hexOrQuotedStringToBytes(ssidStr);
+        ArrayList<Byte> ssidBytes = hexOrQuotedStringToBytes(ssidStr);
+        if (ssidBytes.size() > SSID_BYTES_MAX_LEN) {
+            throw new IllegalArgumentException("ssid bytes size out of range: " + ssidBytes.size());
+        }
+        return ssidBytes;
     }
 
     /**
@@ -286,6 +291,9 @@ public class NativeUtil {
      * @throws IllegalArgumentException for null bytes.
      */
     public static String encodeSsid(ArrayList<Byte> ssidBytes) {
+        if (ssidBytes.size() > SSID_BYTES_MAX_LEN) {
+            throw new IllegalArgumentException("ssid bytes size out of range: " + ssidBytes.size());
+        }
         return bytesToHexOrQuotedString(ssidBytes);
     }