ril: Align to AOSP libril
* Adjusted whitespace to minimize diffs
* Plugged memory leaks
* Fix use-after-free
* Use calloc instead of alloca
* Reworked the Samsung request/response code to be
more readable
Change-Id: Ifd07b525fc84e8a3fca584d4d412785974ca3482
diff --git a/ril/include/libril/ril_ex.h b/ril/include/libril/ril_ex.h
index 8e15d65..692e4df 100644
--- a/ril/include/libril/ril_ex.h
+++ b/ril/include/libril/ril_ex.h
@@ -37,7 +37,7 @@
RIL_SOCKET_ID socket_id;
int fdListen;
int fdCommand;
- char* processName;
+ const char* processName;
struct ril_event* commands_event;
struct ril_event* listen_event;
void (*processCommandsCallback)(int fd, short flags, void *param);
diff --git a/ril/libril/Android.mk b/ril/libril/Android.mk
index 6f39c99..7939867 100644
--- a/ril/libril/Android.mk
+++ b/ril/libril/Android.mk
@@ -22,6 +22,10 @@
LOCAL_STATIC_LIBRARIES := \
libprotobuf-c-nano-enable_malloc \
+ifeq ($(SIM_COUNT), 2)
+ LOCAL_CFLAGS += -DANDROID_SIM_COUNT_2
+endif
+
ifneq ($(filter xmm6262 xmm6360,$(BOARD_MODEM_TYPE)),)
LOCAL_CFLAGS := -DMODEM_TYPE_XMM6262
endif
@@ -42,10 +46,12 @@
LOCAL_EXPORT_C_INCLUDE_DIRS := $(LOCAL_PATH)/../include
LOCAL_MODULE:= libril
+LOCAL_CLANG := true
LOCAL_SANITIZE := integer
include $(BUILD_SHARED_LIBRARY)
+
# For RdoServD which needs a static library
# =========================================
ifneq ($(ANDROID_BIONIC_TRANSITION),)
@@ -60,11 +66,13 @@
librilutils_static \
libprotobuf-c-nano-enable_malloc
+LOCAL_CFLAGS :=
+
ifneq ($(filter xmm6262 xmm6360,$(BOARD_MODEM_TYPE)),)
-LOCAL_CFLAGS := -DMODEM_TYPE_XMM6262
+LOCAL_CFLAGS += -DMODEM_TYPE_XMM6262
endif
ifeq ($(BOARD_MODEM_TYPE),xmm6260)
-LOCAL_CFLAGS := -DMODEM_TYPE_XMM6260
+LOCAL_CFLAGS += -DMODEM_TYPE_XMM6260
endif
LOCAL_MODULE:= libril_static
diff --git a/ril/libril/RilSapSocket.cpp b/ril/libril/RilSapSocket.cpp
index 19457f4..33eabb5 100644
--- a/ril/libril/RilSapSocket.cpp
+++ b/ril/libril/RilSapSocket.cpp
@@ -21,6 +21,7 @@
#include "RilSapSocket.h"
#include "pb_decode.h"
#include "pb_encode.h"
+#undef LOG_TAG
#define LOG_TAG "RIL_UIM_SOCKET"
#include <utils/Log.h>
#include <arpa/inet.h>
@@ -344,15 +345,20 @@
if ((success = pb_get_encoded_size(&encoded_size, MsgHeader_fields,
hdr)) && encoded_size <= INT32_MAX && commandFd != -1) {
buffer_size = encoded_size + sizeof(uint32_t);
- uint8_t buffer[buffer_size];
+ uint8_t* buffer = (uint8_t*)malloc(buffer_size);
+ if (!buffer) {
+ RLOGE("sendResponse: OOM");
+ pthread_mutex_unlock(&write_lock);
+ return;
+ }
written_size = htonl((uint32_t) encoded_size);
ostream = pb_ostream_from_buffer(buffer, buffer_size);
pb_write(&ostream, (uint8_t *)&written_size, sizeof(written_size));
success = pb_encode(&ostream, MsgHeader_fields, hdr);
if (success) {
- RLOGD("Size: %d (0x%x) Size as written: 0x%x", encoded_size, encoded_size,
- written_size);
+ RLOGD("Size: %zu (0x%zx) Size as written: 0x%x", encoded_size,
+ encoded_size, written_size);
log_hex("onRequestComplete", &buffer[sizeof(written_size)], encoded_size);
RLOGI("[%d] < SAP RESPONSE type: %d. id: %d. error: %d",
hdr->token, hdr->type, hdr->id,hdr->error );
@@ -363,12 +369,13 @@
RLOGD("Write successful");
}
} else {
- RLOGE("Error while encoding response of type %d id %d buffer_size: %d: %s.",
- hdr->type, hdr->id, buffer_size, PB_GET_ERROR(&ostream));
+ RLOGE("Error while encoding response of type %d id %d buffer_size: %zu: %s.",
+ hdr->type, hdr->id, buffer_size, PB_GET_ERROR(&ostream));
}
+ free(buffer);
} else {
- RLOGE("Not sending response type %d: encoded_size: %u. commandFd: %d. encoded size result: %d",
- hdr->type, encoded_size, commandFd, success);
+ RLOGE("Not sending response type %d: encoded_size: %zu. commandFd: %d. encoded size result:\
+ %d", hdr->type, encoded_size, commandFd, success);
}
pthread_mutex_unlock(&write_lock);
@@ -437,7 +444,11 @@
if ((success = pb_get_encoded_size(&encoded_size, RIL_SIM_SAP_DISCONNECT_REQ_fields,
&disconnectReq)) && encoded_size <= INT32_MAX) {
buffer_size = encoded_size + sizeof(uint32_t);
- uint8_t buffer[buffer_size];
+ uint8_t* buffer = (uint8_t*)malloc(buffer_size);
+ if (!buffer) {
+ RLOGE("sendDisconnect: OOM");
+ return;
+ }
written_size = htonl((uint32_t) encoded_size);
ostream = pb_ostream_from_buffer(buffer, buffer_size);
pb_write(&ostream, (uint8_t *)&written_size, sizeof(written_size));
@@ -469,6 +480,7 @@
else {
RLOGE("Encode failed in send disconnect!");
}
+ free(buffer);
}
}
diff --git a/ril/libril/ril.cpp b/ril/libril/ril.cpp
index 5b31ed5..a2d1e4e 100755
--- a/ril/libril/ril.cpp
+++ b/ril/libril/ril.cpp
@@ -42,7 +42,6 @@
#include <errno.h>
#include <assert.h>
#include <ctype.h>
-#include <alloca.h>
#include <sys/un.h>
#include <assert.h>
#include <netinet/in.h>
@@ -108,8 +107,8 @@
#if RILC_LOG
#define startRequest sprintf(printBuf, "(")
#define closeRequest sprintf(printBuf, "%s)", printBuf)
- #define printRequest(token, req) \
- RLOGD("[%04d]> %s %s", token, requestToString(req), printBuf)
+ #define printRequest(token, req) \
+ RLOGD("[%04d]> %s %s", token, requestToString(req), printBuf)
#define startResponse sprintf(printBuf, "%s {", printBuf)
#define closeResponse sprintf(printBuf, "%s}", printBuf)
@@ -286,8 +285,9 @@
static void dispatchSimAuthentication(Parcel &p, RequestInfo *pRI);
static void dispatchDataProfile(Parcel &p, RequestInfo *pRI);
static void dispatchRadioCapability(Parcel &p, RequestInfo *pRI);
+static void dispatchCarrierRestrictions(Parcel &p, RequestInfo *pRI);
static int responseInts(Parcel &p, void *response, size_t responselen);
-static int responseIntsGetPreferredNetworkType(Parcel &p, void *response, size_t responselen);
+static int responseFailCause(Parcel &p, void *response, size_t responselen);
static int responseStrings(Parcel &p, void *response, size_t responselen);
static int responseString(Parcel &p, void *response, size_t responselen);
static int responseVoid(Parcel &p, void *response, size_t responselen);
@@ -319,6 +319,8 @@
static int responseLceData(Parcel &p, void *response, size_t responselen);
static int responseActivityData(Parcel &p, void *response, size_t responselen);
+static int responseCarrierRestrictions(Parcel &p, void *response, size_t responselen);
+static int responsePcoData(Parcel &p, void *response, size_t responselen);
static int decodeVoiceRadioTechnology (RIL_RadioState radioState);
static int decodeCdmaSubscriptionSource (RIL_RadioState radioState);
static RIL_RadioState processRadioState(RIL_RadioState newRadioState);
@@ -483,13 +485,13 @@
pRI->local = 1;
pRI->token = 0xffffffff; // token is not used in this context
- /* Check vendor commands */
+ pRI->pCI = &(s_commands[request]);
+ pRI->socket_id = socket_id;
+
+ /* Hack to include Samsung requests */
if (request > RIL_VENDOR_COMMANDS_OFFSET) {
pRI->pCI = &(s_commands_v[request - RIL_VENDOR_COMMANDS_OFFSET]);
- } else {
- pRI->pCI = &(s_commands[request]);
}
- pRI->socket_id = socket_id;
ret = pthread_mutex_lock(pendingRequestsMutexHook);
assert (ret == 0);
@@ -582,7 +584,7 @@
return 0;
}
- pRI = (RequestInfo *)calloc(1, sizeof(RequestInfo));
+ pRI = (RequestInfo *)calloc(1, sizeof(RequestInfo));
if (pRI == NULL) {
RLOGE("Memory allocation failed for request %s", requestToString(request));
return 0;
@@ -668,7 +670,7 @@
startRequest;
if (countStrings == 0) {
// just some non-null pointer
- pStrings = (char **)alloca(sizeof(char *));
+ pStrings = (char **)calloc(1, sizeof(char *));
if (pStrings == NULL) {
RLOGE("Memory allocation failed for request %s",
requestToString(pRI->pCI->requestNumber));
@@ -677,13 +679,13 @@
}
datalen = 0;
- } else if (((int)countStrings) == -1) {
+ } else if (countStrings < 0) {
pStrings = NULL;
datalen = 0;
} else {
datalen = sizeof(char *) * countStrings;
- pStrings = (char **)alloca(datalen);
+ pStrings = (char **)calloc(countStrings, sizeof(char *));
if (pStrings == NULL) {
RLOGE("Memory allocation failed for request %s",
requestToString(pRI->pCI->requestNumber));
@@ -713,6 +715,7 @@
#ifdef MEMSET_FREED
memset(pStrings, 0, datalen);
#endif
+ free(pStrings);
}
return;
@@ -731,12 +734,12 @@
status = p.readInt32 (&count);
- if (status != NO_ERROR || count == 0) {
+ if (status != NO_ERROR || count <= 0) {
goto invalid;
}
datalen = sizeof(int) * count;
- pInts = (int *)alloca(datalen);
+ pInts = (int *)calloc(count, sizeof(int));
if (pInts == NULL) {
RLOGE("Memory allocation failed for request %s", requestToString(pRI->pCI->requestNumber));
return;
@@ -751,6 +754,7 @@
appendPrintBuf("%s%d,", printBuf, t);
if (status != NO_ERROR) {
+ free(pInts);
goto invalid;
}
}
@@ -764,7 +768,7 @@
#ifdef MEMSET_FREED
memset(pInts, 0, datalen);
#endif
-
+ free(pInts);
return;
invalid:
invalidCommandBlock(pRI);
@@ -1376,7 +1380,7 @@
(int)rism.tech, (int)rism.retry, rism.messageRef);
if (countStrings == 0) {
// just some non-null pointer
- pStrings = (char **)alloca(sizeof(char *));
+ pStrings = (char **)calloc(1, sizeof(char *));
if (pStrings == NULL) {
RLOGE("Memory allocation failed for request %s",
requestToString(pRI->pCI->requestNumber));
@@ -1385,13 +1389,18 @@
}
datalen = 0;
- } else if (((int)countStrings) == -1) {
+ } else if (countStrings < 0) {
pStrings = NULL;
datalen = 0;
} else {
+ if ((size_t)countStrings > (INT_MAX/sizeof(char *))) {
+ RLOGE("Invalid value of countStrings: \n");
+ closeRequest;
+ return;
+ }
datalen = sizeof(char *) * countStrings;
- pStrings = (char **)alloca(datalen);
+ pStrings = (char **)calloc(countStrings, sizeof(char *));
if (pStrings == NULL) {
RLOGE("Memory allocation failed for request %s",
requestToString(pRI->pCI->requestNumber));
@@ -1424,6 +1433,7 @@
#ifdef MEMSET_FREED
memset(pStrings, 0, datalen);
#endif
+ free(pStrings);
}
#ifdef MEMSET_FREED
@@ -1431,7 +1441,7 @@
#endif
return;
invalid:
- RLOGE("dispatchImsGsmSms invalid block");
+ ALOGE("dispatchImsGsmSms invalid block");
invalidCommandBlock(pRI);
return;
}
@@ -1466,7 +1476,7 @@
} else if (RADIO_TECH_3GPP2 == format) {
dispatchImsCdmaSms(p, pRI, retry, messageRef);
} else {
- RLOGE("requestImsSendSMS invalid format value =%d", format);
+ ALOGE("requestImsSendSMS invalid format value =%d", format);
}
return;
@@ -1838,7 +1848,7 @@
pf.password = strdupReadString(p);
startRequest;
- appendPrintBuf("%sapn=%s, protocol=%s, auth_type=%d, username=%s, password=%s",
+ appendPrintBuf("%sapn=%s, protocol=%s, authtype=%d, username=%s, password=%s",
printBuf, pf.apn, pf.protocol, pf.authtype, pf.username, pf.password);
closeRequest;
printRequest(pRI->token, pRI->pCI->requestNumber);
@@ -2010,7 +2020,7 @@
pf.aid = strdupReadString(p);
startRequest;
- appendPrintBuf("authContext=%d, authData=%s, aid=%s", pf.authContext, pf.authData, pf.aid);
+ appendPrintBuf("authContext=%s, authData=%s, aid=%s", pf.authContext, pf.authData, pf.aid);
closeRequest;
printRequest(pRI->token, pRI->pCI->requestNumber);
@@ -2043,20 +2053,20 @@
int32_t num;
status = p.readInt32(&num);
- if (status != NO_ERROR) {
+ if (status != NO_ERROR || num < 0) {
goto invalid;
}
{
RIL_DataProfileInfo *dataProfiles =
- (RIL_DataProfileInfo *)malloc(num * sizeof(RIL_DataProfileInfo));
+ (RIL_DataProfileInfo *)calloc(num, sizeof(RIL_DataProfileInfo));
if (dataProfiles == NULL) {
RLOGE("Memory allocation failed for request %s",
requestToString(pRI->pCI->requestNumber));
return;
}
RIL_DataProfileInfo **dataProfilePtrs =
- (RIL_DataProfileInfo **)malloc(num * sizeof(RIL_DataProfileInfo *));
+ (RIL_DataProfileInfo **)calloc(num, sizeof(RIL_DataProfileInfo *));
if (dataProfilePtrs == NULL) {
RLOGE("Memory allocation failed for request %s",
requestToString(pRI->pCI->requestNumber));
@@ -2174,7 +2184,7 @@
startRequest;
appendPrintBuf("%s [version:%d, session:%d, phase:%d, rat:%d, \
logicalModemUuid:%s, status:%d", printBuf, rc.version, rc.session,
- rc.phase, rc.rat, rc.logicalModemUuid, rc.status);
+ rc.phase, rc.rat, rc.logicalModemUuid, rc.session);
closeRequest;
printRequest(pRI->token, pRI->pCI->requestNumber);
@@ -2189,6 +2199,105 @@
return;
}
+/**
+ * Callee expects const RIL_CarrierRestrictions *
+ */
+static void dispatchCarrierRestrictions(Parcel &p, RequestInfo *pRI) {
+ RIL_CarrierRestrictions cr;
+ RIL_Carrier * allowed_carriers = NULL;
+ RIL_Carrier * excluded_carriers = NULL;
+ int32_t t;
+ status_t status;
+
+ memset(&cr, 0, sizeof(RIL_CarrierRestrictions));
+
+ if (s_callbacks.version < 14) {
+ RLOGE("Unsuppoted RIL version %d, min version expected %d",
+ s_callbacks.version, 14);
+ RIL_onRequestComplete(pRI, RIL_E_REQUEST_NOT_SUPPORTED, NULL, 0);
+ return;
+ }
+
+ status = p.readInt32(&t);
+ if (status != NO_ERROR) {
+ goto invalid;
+ }
+ allowed_carriers = (RIL_Carrier *)calloc(t, sizeof(RIL_Carrier));
+ if (allowed_carriers == NULL) {
+ RLOGE("Memory allocation failed for request %s", requestToString(pRI->pCI->requestNumber));
+ goto exit;
+ }
+ cr.len_allowed_carriers = t;
+ cr.allowed_carriers = allowed_carriers;
+
+ status = p.readInt32(&t);
+ if (status != NO_ERROR) {
+ goto invalid;
+ }
+ excluded_carriers = (RIL_Carrier *)calloc(t, sizeof(RIL_Carrier));
+ if (excluded_carriers == NULL) {
+ RLOGE("Memory allocation failed for request %s", requestToString(pRI->pCI->requestNumber));
+ goto exit;
+ }
+ cr.len_excluded_carriers = t;
+ cr.excluded_carriers = excluded_carriers;
+
+ startRequest;
+ appendPrintBuf("%s len_allowed_carriers:%d, len_excluded_carriers:%d,",
+ printBuf, cr.len_allowed_carriers, cr.len_excluded_carriers);
+
+ appendPrintBuf("%s allowed_carriers:", printBuf);
+ for (int32_t i = 0; i < cr.len_allowed_carriers; i++) {
+ RIL_Carrier *p_cr = allowed_carriers + i;
+ p_cr->mcc = strdupReadString(p);
+ p_cr->mnc = strdupReadString(p);
+ status = p.readInt32(&t);
+ p_cr->match_type = static_cast<RIL_CarrierMatchType>(t);
+ if (status != NO_ERROR) {
+ goto invalid;
+ }
+ p_cr->match_data = strdupReadString(p);
+ appendPrintBuf("%s [%d mcc:%s, mnc:%s, match_type:%d, match_data:%s],",
+ printBuf, i, p_cr->mcc, p_cr->mnc, p_cr->match_type, p_cr->match_data);
+ }
+
+ for (int32_t i = 0; i < cr.len_excluded_carriers; i++) {
+ RIL_Carrier *p_cr = excluded_carriers + i;
+ p_cr->mcc = strdupReadString(p);
+ p_cr->mnc = strdupReadString(p);
+ status = p.readInt32(&t);
+ p_cr->match_type = static_cast<RIL_CarrierMatchType>(t);
+ if (status != NO_ERROR) {
+ goto invalid;
+ }
+ p_cr->match_data = strdupReadString(p);
+ appendPrintBuf("%s [%d mcc:%s, mnc:%s, match_type:%d, match_data:%s],",
+ printBuf, i, p_cr->mcc, p_cr->mnc, p_cr->match_type, p_cr->match_data);
+ }
+
+ closeRequest;
+ printRequest(pRI->token, pRI->pCI->requestNumber);
+
+ CALL_ONREQUEST(pRI->pCI->requestNumber,
+ &cr,
+ sizeof(RIL_CarrierRestrictions),
+ pRI, pRI->socket_id);
+
+ goto exit;
+
+invalid:
+ invalidCommandBlock(pRI);
+ RIL_onRequestComplete(pRI, RIL_E_INVALID_ARGUMENTS, NULL, 0);
+exit:
+ if (allowed_carriers != NULL) {
+ free(allowed_carriers);
+ }
+ if (excluded_carriers != NULL) {
+ free(excluded_carriers);
+ }
+ return;
+}
+
static int
blockingWrite(int fd, const void *buffer, size_t len) {
size_t writeOffset = 0;
@@ -2225,7 +2334,7 @@
pthread_mutex_t * writeMutexHook = &s_writeMutex;
#if VDBG
- RLOGD("Send Response to %s", rilSocketIdToString(socket_id));
+ RLOGE("Send Response to %s", rilSocketIdToString(socket_id));
#endif
#if (SIM_COUNT >= 2)
@@ -2319,38 +2428,38 @@
return 0;
}
-static int
-responseIntsGetPreferredNetworkType(Parcel &p, void *response, size_t responselen) {
+// Response is an int or RIL_LastCallFailCauseInfo.
+// Currently, only Shamu plans to use RIL_LastCallFailCauseInfo.
+// TODO(yjl): Let all implementations use RIL_LastCallFailCauseInfo.
+static int responseFailCause(Parcel &p, void *response, size_t responselen) {
int numInts;
if (response == NULL && responselen != 0) {
RLOGE("invalid response: NULL");
return RIL_ERRNO_INVALID_RESPONSE;
}
- if (responselen % sizeof(int) != 0) {
- RLOGE("responseInts: invalid response length %d expected multiple of %d\n",
- (int)responselen, (int)sizeof(int));
- return RIL_ERRNO_INVALID_RESPONSE;
+ if (responselen == sizeof(int)) {
+ startResponse;
+ int *p_int = (int *) response;
+ appendPrintBuf("%s%d,", printBuf, p_int[0]);
+ p.writeInt32(p_int[0]);
+ removeLastChar;
+ closeResponse;
+ } else if (responselen == sizeof(RIL_LastCallFailCauseInfo)) {
+ startResponse;
+ RIL_LastCallFailCauseInfo *p_fail_cause_info = (RIL_LastCallFailCauseInfo *) response;
+ appendPrintBuf("%s[cause_code=%d,vendor_cause=%s]", printBuf, p_fail_cause_info->cause_code,
+ p_fail_cause_info->vendor_cause);
+ p.writeInt32(p_fail_cause_info->cause_code);
+ writeStringToParcel(p, p_fail_cause_info->vendor_cause);
+ removeLastChar;
+ closeResponse;
+ } else {
+ RLOGE("responseFailCause: invalid response length %d expected an int or "
+ "RIL_LastCallFailCauseInfo", (int)responselen);
+ return RIL_ERRNO_INVALID_RESPONSE;
}
- int *p_int = (int *) response;
-
- numInts = responselen / sizeof(int);
- p.writeInt32 (numInts);
-
- /* each int*/
- startResponse;
- for (int i = 0 ; i < numInts ; i++) {
- if (i == 0 && p_int[0] == 7) {
- RLOGD("REQUEST_GET_PREFERRED_NETWORK_TYPE: NETWORK_MODE_GLOBAL => NETWORK_MODE_WCDMA_PREF");
- p_int[0] = 0;
- }
- appendPrintBuf("%s%d,", printBuf, p_int[i]);
- p.writeInt32(p_int[i]);
- }
- removeLastChar;
- closeResponse;
-
return 0;
}
@@ -2601,7 +2710,7 @@
writeStringToParcel(p, p_cur[i].ifname);
writeStringToParcel(p, p_cur[i].addresses);
writeStringToParcel(p, p_cur[i].dnses);
- writeStringToParcel(p, p_cur[i].addresses);
+ writeStringToParcel(p, p_cur[i].gateways);
appendPrintBuf("%s[status=%d,retry=%d,cid=%d,%s,%s,%s,%s,%s,%s],", printBuf,
p_cur[i].status,
p_cur[i].suggestedRetryTime,
@@ -2611,7 +2720,7 @@
(char*)p_cur[i].ifname,
(char*)p_cur[i].addresses,
(char*)p_cur[i].dnses,
- (char*)p_cur[i].addresses);
+ (char*)p_cur[i].gateways);
}
removeLastChar;
closeResponse;
@@ -2954,8 +3063,7 @@
CDMA_ALPHA_INFO_BUFFER_LENGTH);
return RIL_ERRNO_INVALID_RESPONSE;
}
- string8 = (char*) malloc((infoRec->rec.display.alpha_len + 1)
- * sizeof(char) );
+ string8 = (char*) calloc(infoRec->rec.display.alpha_len + 1, sizeof(char));
if (string8 == NULL) {
RLOGE("Memory allocation failed for responseCdmaInformationRecords");
closeRequest;
@@ -2979,8 +3087,7 @@
CDMA_NUMBER_INFO_BUFFER_LENGTH);
return RIL_ERRNO_INVALID_RESPONSE;
}
- string8 = (char*) malloc((infoRec->rec.number.len + 1)
- * sizeof(char) );
+ string8 = (char*) calloc(infoRec->rec.number.len + 1, sizeof(char));
if (string8 == NULL) {
RLOGE("Memory allocation failed for responseCdmaInformationRecords");
closeRequest;
@@ -3021,8 +3128,8 @@
CDMA_NUMBER_INFO_BUFFER_LENGTH);
return RIL_ERRNO_INVALID_RESPONSE;
}
- string8 = (char*) malloc((infoRec->rec.redir.redirectingNumber
- .len + 1) * sizeof(char) );
+ string8 = (char*) calloc(infoRec->rec.redir.redirectingNumber.len + 1,
+ sizeof(char));
if (string8 == NULL) {
RLOGE("Memory allocation failed for responseCdmaInformationRecords");
closeRequest;
@@ -3106,9 +3213,6 @@
gsmSignalStrength = 31;
}
#endif
- p.writeInt32(gsmSignalStrength);
-
- p.writeInt32(p_cur->GW_SignalStrength.bitErrorRate);
#if defined(MODEM_TYPE_XMM6262) || defined(SAMSUNG_NEXT_GEN_MODEM)
cdmaDbm = p_cur->CDMA_SignalStrength.dbm & 0xFF;
@@ -3120,8 +3224,6 @@
#else
cdmaDbm = p_cur->CDMA_SignalStrength.dbm;
#endif
- p.writeInt32(cdmaDbm);
- p.writeInt32(p_cur->CDMA_SignalStrength.ecio);
#if defined(MODEM_TYPE_XMM6262) || defined(SAMSUNG_NEXT_GEN_MODEM)
evdoDbm = p_cur->EVDO_SignalStrength.dbm & 0xFF;
@@ -3133,9 +3235,14 @@
#else
evdoDbm = p_cur->EVDO_SignalStrength.dbm;
#endif
- p.writeInt32(evdoDbm);
- p.writeInt32(p_cur->EVDO_SignalStrength.ecio);
- p.writeInt32(p_cur->EVDO_SignalStrength.signalNoiseRatio);
+
+ p.writeInt32(gsmSignalStrength);
+ p.writeInt32(p_cur->GW_SignalStrength.bitErrorRate);
+ p.writeInt32(cdmaDbm);
+ p.writeInt32(p_cur->CDMA_SignalStrength.ecio);
+ p.writeInt32(evdoDbm);
+ p.writeInt32(p_cur->EVDO_SignalStrength.ecio);
+ p.writeInt32(p_cur->EVDO_SignalStrength.signalNoiseRatio);
}
static void responseRilSignalStrengthV6Extra(Parcel &p, RIL_SignalStrength_v10 *p_cur) {
@@ -3177,7 +3284,6 @@
p.writeInt32(p_cur->TD_SCDMA_SignalStrength.rscp);
}
-
static int responseRilSignalStrength(Parcel &p,
void *response, size_t responselen) {
if (response == NULL && responselen != 0) {
@@ -3223,7 +3329,6 @@
p_cur = ((RIL_SignalStrength_v10 *) response);
responseRilSignalStrengthV10(p, p_cur);
}
-
startResponse;
appendPrintBuf("%s[signalStrength=%d,bitErrorRate=%d,\
CDMA_SS.dbm=%d,CDMA_SSecio=%d,\
@@ -3436,6 +3541,8 @@
p.writeInt32(p_cur->CellInfo.gsm.cellIdentityGsm.mnc);
p.writeInt32(p_cur->CellInfo.gsm.cellIdentityGsm.lac);
p.writeInt32(p_cur->CellInfo.gsm.cellIdentityGsm.cid);
+ p.writeInt32(INT_MAX); /* skip arfcn */
+ p.writeInt32(INT_MAX); /* skip bsic */
p.writeInt32(p_cur->CellInfo.gsm.signalStrengthGsm.signalStrength);
p.writeInt32(p_cur->CellInfo.gsm.signalStrengthGsm.bitErrorRate);
break;
@@ -3456,6 +3563,7 @@
p.writeInt32(p_cur->CellInfo.wcdma.cellIdentityWcdma.lac);
p.writeInt32(p_cur->CellInfo.wcdma.cellIdentityWcdma.cid);
p.writeInt32(p_cur->CellInfo.wcdma.cellIdentityWcdma.psc);
+ p.writeInt32(INT_MAX); /* skip uarfcn */
p.writeInt32(p_cur->CellInfo.wcdma.signalStrengthWcdma.signalStrength);
p.writeInt32(p_cur->CellInfo.wcdma.signalStrengthWcdma.bitErrorRate);
break;
@@ -3501,6 +3609,7 @@
p.writeInt32(p_cur->CellInfo.lte.cellIdentityLte.ci);
p.writeInt32(p_cur->CellInfo.lte.cellIdentityLte.pci);
p.writeInt32(p_cur->CellInfo.lte.cellIdentityLte.tac);
+ p.writeInt32(INT_MAX); /* skip earfcn */
appendPrintBuf("%s lteSS: ss=%d,rsrp=%d,rsrq=%d,rssnr=%d,cqi=%d,ta=%d", printBuf,
p_cur->CellInfo.lte.signalStrengthLte.signalStrength,
@@ -3851,7 +3960,7 @@
startResponse;
appendPrintBuf("%s[version=%d,session=%d,phase=%d,\
- rat=%d,logicalModemUuid=%s,status=%d]",
+ rat=%s,logicalModemUuid=%s,status=%d]",
printBuf,
p_cur->version,
p_cur->session,
@@ -4162,7 +4271,7 @@
p.writeInt32(pDcRtInfo->powerState);
appendPrintBuf("%s[time=%d,powerState=%d]", printBuf,
pDcRtInfo->time,
- (int)pDcRtInfo->powerState);
+ pDcRtInfo->powerState);
closeResponse;
return 0;
@@ -4174,8 +4283,8 @@
RLOGE("invalid response: NULL");
}
else {
- RLOGE("responseLceStatus: invalid response length %d expecting len: d%",
- sizeof(RIL_LceStatusInfo), responselen);
+ RLOGE("responseLceStatus: invalid response length %u expecting len: %u",
+ (unsigned)sizeof(RIL_LceStatusInfo), (unsigned)responselen);
}
return RIL_ERRNO_INVALID_RESPONSE;
}
@@ -4198,8 +4307,8 @@
RLOGE("invalid response: NULL");
}
else {
- RLOGE("responseLceData: invalid response length %d expecting len: d%",
- sizeof(RIL_LceDataInfo), responselen);
+ RLOGE("responseLceData: invalid response length %u expecting len: %u",
+ (unsigned)sizeof(RIL_LceDataInfo), (unsigned)responselen);
}
return RIL_ERRNO_INVALID_RESPONSE;
}
@@ -4227,8 +4336,8 @@
RLOGE("invalid response: NULL");
}
else {
- RLOGE("responseActivityData: invalid response length %d expecting len: d%",
- sizeof(RIL_ActivityStatsInfo), responselen);
+ RLOGE("responseActivityData: invalid response length %u expecting len: %u",
+ (unsigned)sizeof(RIL_ActivityStatsInfo), (unsigned)responselen);
}
return RIL_ERRNO_INVALID_RESPONSE;
}
@@ -4252,6 +4361,78 @@
return 0;
}
+static int responseCarrierRestrictions(Parcel &p, void *response, size_t responselen) {
+ if (response == NULL) {
+ RLOGE("invalid response: NULL");
+ return RIL_ERRNO_INVALID_RESPONSE;
+ }
+ if (responselen != sizeof(RIL_CarrierRestrictions)) {
+ RLOGE("responseCarrierRestrictions: invalid response length %u expecting len: %u",
+ (unsigned)responselen, (unsigned)sizeof(RIL_CarrierRestrictions));
+ return RIL_ERRNO_INVALID_RESPONSE;
+ }
+
+ RIL_CarrierRestrictions *p_cr = (RIL_CarrierRestrictions *)response;
+ startResponse;
+
+ p.writeInt32(p_cr->len_allowed_carriers);
+ p.writeInt32(p_cr->len_excluded_carriers);
+ appendPrintBuf(" %s len_allowed_carriers: %d, len_excluded_carriers: %d,", printBuf,
+ p_cr->len_allowed_carriers,p_cr->len_excluded_carriers);
+
+ appendPrintBuf(" %s allowed_carriers:", printBuf);
+ for(int32_t i = 0; i < p_cr->len_allowed_carriers; i++) {
+ RIL_Carrier *carrier = p_cr->allowed_carriers + i;
+ writeStringToParcel(p, carrier->mcc);
+ writeStringToParcel(p, carrier->mnc);
+ p.writeInt32(carrier->match_type);
+ writeStringToParcel(p, carrier->match_data);
+ appendPrintBuf(" %s [%d mcc: %s, mnc: %s, match_type: %d, match_data: %s],", printBuf,
+ i, carrier->mcc, carrier->mnc, carrier->match_type, carrier->match_data);
+ }
+
+ appendPrintBuf(" %s excluded_carriers:", printBuf);
+ for(int32_t i = 0; i < p_cr->len_excluded_carriers; i++) {
+ RIL_Carrier *carrier = p_cr->excluded_carriers + i;
+ writeStringToParcel(p, carrier->mcc);
+ writeStringToParcel(p, carrier->mnc);
+ p.writeInt32(carrier->match_type);
+ writeStringToParcel(p, carrier->match_data);
+ appendPrintBuf(" %s [%d mcc: %s, mnc: %s, match_type: %d, match_data: %s],", printBuf,
+ i, carrier->mcc, carrier->mnc, carrier->match_type, carrier->match_data);
+ }
+
+ closeResponse;
+
+ return 0;
+}
+
+static int responsePcoData(Parcel &p, void *response, size_t responselen) {
+ if (response == NULL) {
+ RLOGE("responsePcoData: invalid NULL response");
+ return RIL_ERRNO_INVALID_RESPONSE;
+ }
+ if (responselen != sizeof(RIL_PCO_Data)) {
+ RLOGE("responsePcoData: invalid response length %u, expecting %u",
+ (unsigned)responselen, (unsigned)sizeof(RIL_PCO_Data));
+ return RIL_ERRNO_INVALID_RESPONSE;
+ }
+
+ RIL_PCO_Data *p_cur = (RIL_PCO_Data *)response;
+ p.writeInt32(p_cur->cid);
+ writeStringToParcel(p, p_cur->bearer_proto);
+ p.writeInt32(p_cur->pco_id);
+ p.writeInt32(p_cur->contents_length);
+ p.write(p_cur->contents, p_cur->contents_length);
+
+ startResponse;
+ appendPrintBuf("PCO data received: cid %d, id %d, length %d",
+ p_cur->cid, p_cur->pco_id, p_cur->contents_length);
+ closeResponse;
+
+ return 0;
+}
+
/**
* A write on the wakeup fd is done just to pop us out of select()
* We empty the buffer here and then ril_event will reset the timers on the
@@ -4398,7 +4579,7 @@
int err;
int is_phone_socket;
int fdCommand = -1;
- char* processName;
+ const char* processName;
RecordStream *p_rs;
MySocketListenParam* listenParam;
RilSocket *sapSocket = NULL;
@@ -4559,7 +4740,13 @@
return;
}
- args = (char **) malloc(sizeof(char*) * number);
+ if (number < 0) {
+ RLOGE ("Invalid number of arguments: \n");
+ close(acceptFD);
+ return;
+ }
+
+ args = (char **) calloc(number, sizeof(char*));
if (args == NULL) {
RLOGE("Memory allocation failed for debug args");
close(acceptFD);
@@ -4575,8 +4762,15 @@
return;
}
+ if (len == INT_MAX || len < 0) {
+ RLOGE("Invalid value of len: \n");
+ freeDebugCallbackArgs(i, args);
+ close(acceptFD);
+ return;
+ }
+
// +1 for null-term
- args[i] = (char *) malloc((sizeof(char) * len) + 1);
+ args[i] = (char *) calloc(len + 1, sizeof(char));
if (args[i] == NULL) {
RLOGE("Memory allocation failed for debug args");
freeDebugCallbackArgs(i, args);
@@ -4888,7 +5082,8 @@
&s_commands_event, /* commands_event */
&s_listen_event, /* listen_event */
processCommandsCallback, /* processCommandsCallback */
- NULL /* p_rs */
+ NULL, /* p_rs */
+ RIL_TELEPHONY_SOCKET /* type */
};
#if (SIM_COUNT >= 2)
@@ -4900,7 +5095,8 @@
&s_commands_event_socket2, /* commands_event */
&s_listen_event_socket2, /* listen_event */
processCommandsCallback, /* processCommandsCallback */
- NULL /* p_rs */
+ NULL, /* p_rs */
+ RIL_TELEPHONY_SOCKET /* type */
};
#endif
@@ -4913,7 +5109,8 @@
&s_commands_event_socket3, /* commands_event */
&s_listen_event_socket3, /* listen_event */
processCommandsCallback, /* processCommandsCallback */
- NULL /* p_rs */
+ NULL, /* p_rs */
+ RIL_TELEPHONY_SOCKET /* type */
};
#endif
@@ -4926,7 +5123,8 @@
&s_commands_event_socket4, /* commands_event */
&s_listen_event_socket4, /* listen_event */
processCommandsCallback, /* processCommandsCallback */
- NULL /* p_rs */
+ NULL, /* p_rs */
+ RIL_TELEPHONY_SOCKET /* type */
};
#endif
@@ -4990,7 +5188,7 @@
char rildebug[MAX_DEBUG_SOCKET_NAME_LENGTH] = SOCKET_NAME_RIL_DEBUG;
if (inst != NULL) {
- snprintf(rildebug, sizeof(rildebug), "%s%s", SOCKET_NAME_RIL_DEBUG, inst);
+ strlcat(rildebug, inst, MAX_DEBUG_SOCKET_NAME_LENGTH);
}
s_fdDebug = android_get_control_socket(rildebug);
@@ -5038,6 +5236,8 @@
#if (SIM_COUNT >= 4)
RilSapSocket::initSapSocket("sap_uim_socket4", UimFuncs);
#endif
+ break;
+ default:;
}
}
}
@@ -5434,12 +5634,14 @@
size_t datalen)
#endif
{
+ int unsolResponseIndex;
int ret;
int64_t timeReceived = 0;
bool shouldScheduleTimeout = false;
RIL_RadioState newState;
RIL_SOCKET_ID soc_id = RIL_SOCKET_1;
UnsolResponseInfo *pRI = NULL;
+ int32_t pRI_elements;
#if defined(ANDROID_MULTI_SIM)
soc_id = socket_id;
@@ -5452,18 +5654,25 @@
return;
}
+ unsolResponseIndex = unsolResponse - RIL_UNSOL_RESPONSE_BASE;
+ pRI = s_unsolResponses;
+
/* Hack to include Samsung responses */
if (unsolResponse > RIL_VENDOR_COMMANDS_OFFSET + RIL_UNSOL_RESPONSE_BASE) {
- int index = unsolResponse - RIL_VENDOR_COMMANDS_OFFSET - RIL_UNSOL_RESPONSE_BASE;
+ unsolResponseIndex -= RIL_VENDOR_COMMANDS_OFFSET;
+ pRI = s_unsolResponses_v;
- RLOGD("SAMSUNG: unsolResponse=%d, unsolResponseIndex=%d", unsolResponse, index);
+ RLOGD("SAMSUNG: unsolResponse=%d, unsolResponseIndex=%d", unsolResponse, unsolResponseIndex);
+ }
- if (index < (int32_t)NUM_ELEMS(s_unsolResponses_v))
- pRI = &s_unsolResponses_v[index];
+ pRI_elements = pRI == s_unsolResponses
+ ? (int32_t)NUM_ELEMS(s_unsolResponses) : (int32_t)NUM_ELEMS(s_unsolResponses_v);
+
+ if (unsolResponseIndex >= 0 && unsolResponseIndex < pRI_elements) {
+ pRI = &pRI[unsolResponseIndex];
} else {
- int index = unsolResponse - RIL_UNSOL_RESPONSE_BASE;
- if (index < (int32_t)NUM_ELEMS(s_unsolResponses))
- pRI = &s_unsolResponses[index];
+ RLOGE("unsolResponseIndex out of bounds: %d, using %s response array", unsolResponseIndex,
+ pRI == s_unsolResponses ? "AOSP" : "Samsung");
}
if (pRI == NULL || pRI->responseFunction == NULL) {
@@ -5566,7 +5775,7 @@
s_lastNITZTimeData = NULL;
}
- s_lastNITZTimeData = malloc(p.dataSize());
+ s_lastNITZTimeData = calloc(p.dataSize(), 1);
if (s_lastNITZTimeData == NULL) {
RLOGE("Memory allocation failed in RIL_onUnsolicitedResponse");
goto error_exit;
@@ -5594,7 +5803,7 @@
struct timeval myRelativeTime;
UserCallbackInfo *p_info;
- p_info = (UserCallbackInfo *) malloc (sizeof(UserCallbackInfo));
+ p_info = (UserCallbackInfo *) calloc(1, sizeof(UserCallbackInfo));
if (p_info == NULL) {
RLOGE("Memory allocation failed in internalRequestTimedCallback");
return p_info;
@@ -5824,6 +6033,7 @@
case RIL_REQUEST_QUERY_CLIP: return "QUERY_CLIP";
case RIL_REQUEST_LAST_DATA_CALL_FAIL_CAUSE: return "LAST_DATA_CALL_FAIL_CAUSE";
case RIL_REQUEST_DATA_CALL_LIST: return "DATA_CALL_LIST";
+ case RIL_REQUEST_NV_RESET_CONFIG: return "NV_RESET_CONFIG";
case RIL_REQUEST_RESET_RADIO: return "RESET_RADIO";
case RIL_REQUEST_OEM_HOOK_RAW: return "OEM_HOOK_RAW";
case RIL_REQUEST_OEM_HOOK_STRINGS: return "OEM_HOOK_STRINGS";
@@ -5887,6 +6097,8 @@
case RIL_REQUEST_GET_DC_RT_INFO: return "GET_DC_RT_INFO";
case RIL_REQUEST_SET_DC_RT_INFO_RATE: return "SET_DC_RT_INFO_RATE";
case RIL_REQUEST_SET_DATA_PROFILE: return "SET_DATA_PROFILE";
+ case RIL_REQUEST_SET_CARRIER_RESTRICTIONS: return "SET_CARRIER_RESTRICTIONS";
+ case RIL_REQUEST_GET_CARRIER_RESTRICTIONS: return "GET_CARRIER_RESTRICTIONS";
case RIL_UNSOL_RESPONSE_RADIO_STATE_CHANGED: return "UNSOL_RESPONSE_RADIO_STATE_CHANGED";
case RIL_UNSOL_RESPONSE_CALL_STATE_CHANGED: return "UNSOL_RESPONSE_CALL_STATE_CHANGED";
case RIL_UNSOL_RESPONSE_VOICE_NETWORK_STATE_CHANGED: return "UNSOL_RESPONSE_VOICE_NETWORK_STATE_CHANGED";
@@ -5897,7 +6109,6 @@
case RIL_UNSOL_ON_USSD_REQUEST: return "UNSOL_ON_USSD_REQUEST(obsolete)";
case RIL_UNSOL_NITZ_TIME_RECEIVED: return "UNSOL_NITZ_TIME_RECEIVED";
case RIL_UNSOL_SIGNAL_STRENGTH: return "UNSOL_SIGNAL_STRENGTH";
- case RIL_UNSOL_DATA_CALL_LIST_CHANGED: return "UNSOL_DATA_CALL_LIST_CHANGED";
case RIL_UNSOL_SUPP_SVC_NOTIFICATION: return "UNSOL_SUPP_SVC_NOTIFICATION";
case RIL_UNSOL_STK_SESSION_END: return "UNSOL_STK_SESSION_END";
case RIL_UNSOL_STK_PROACTIVE_COMMAND: return "UNSOL_STK_PROACTIVE_COMMAND";
@@ -5905,6 +6116,7 @@
case RIL_UNSOL_STK_CALL_SETUP: return "UNSOL_STK_CALL_SETUP";
case RIL_UNSOL_SIM_SMS_STORAGE_FULL: return "UNSOL_SIM_SMS_STORAGE_FUL";
case RIL_UNSOL_SIM_REFRESH: return "UNSOL_SIM_REFRESH";
+ case RIL_UNSOL_DATA_CALL_LIST_CHANGED: return "UNSOL_DATA_CALL_LIST_CHANGED";
case RIL_UNSOL_CALL_RING: return "UNSOL_CALL_RING";
case RIL_UNSOL_RESPONSE_SIM_STATUS_CHANGED: return "UNSOL_RESPONSE_SIM_STATUS_CHANGED";
case RIL_UNSOL_RESPONSE_CDMA_NEW_SMS: return "UNSOL_NEW_CDMA_SMS";
@@ -5929,11 +6141,12 @@
case RIL_UNSOL_SRVCC_STATE_NOTIFY: return "UNSOL_SRVCC_STATE_NOTIFY";
case RIL_UNSOL_HARDWARE_CONFIG_CHANGED: return "HARDWARE_CONFIG_CHANGED";
case RIL_UNSOL_DC_RT_INFO_CHANGED: return "UNSOL_DC_RT_INFO_CHANGED";
- case RIL_UNSOL_RADIO_CAPABILITY: return "UNSOL_RADIO_CAPABILITY";
case RIL_UNSOL_ON_SS: return "UNSOL_ON_SS";
case RIL_UNSOL_STK_CC_ALPHA_NOTIFY: return "UNSOL_STK_CC_ALPHA_NOTIFY";
case RIL_REQUEST_SHUTDOWN: return "SHUTDOWN";
+ case RIL_UNSOL_RADIO_CAPABILITY: return "RIL_UNSOL_RADIO_CAPABILITY";
case RIL_RESPONSE_ACKNOWLEDGEMENT: return "RIL_RESPONSE_ACKNOWLEDGEMENT";
+ case RIL_UNSOL_PCO_DATA: return "RIL_UNSOL_PCO_DATA";
default: return "<unknown request>";
}
}
diff --git a/ril/libril/ril_commands.h b/ril/libril/ril_commands.h
index 39f8878..8d02c39 100644
--- a/ril/libril/ril_commands.h
+++ b/ril/libril/ril_commands.h
@@ -32,7 +32,7 @@
{RIL_REQUEST_SWITCH_WAITING_OR_HOLDING_AND_ACTIVE, dispatchVoid, responseVoid},
{RIL_REQUEST_CONFERENCE, dispatchVoid, responseVoid},
{RIL_REQUEST_UDUB, dispatchVoid, responseVoid},
- {RIL_REQUEST_LAST_CALL_FAIL_CAUSE, dispatchVoid, responseInts},
+ {RIL_REQUEST_LAST_CALL_FAIL_CAUSE, dispatchVoid, responseFailCause},
{RIL_REQUEST_SIGNAL_STRENGTH, dispatchVoid, responseRilSignalStrength},
{RIL_REQUEST_VOICE_REGISTRATION_STATE, dispatchVoid, responseStrings},
{RIL_REQUEST_DATA_REGISTRATION_STATE, dispatchVoid, responseStrings},
@@ -88,7 +88,7 @@
{RIL_REQUEST_STK_HANDLE_CALL_SETUP_REQUESTED_FROM_SIM, dispatchInts, responseVoid},
{RIL_REQUEST_EXPLICIT_CALL_TRANSFER, dispatchVoid, responseVoid},
{RIL_REQUEST_SET_PREFERRED_NETWORK_TYPE, dispatchInts, responseVoid},
- {RIL_REQUEST_GET_PREFERRED_NETWORK_TYPE, dispatchVoid, responseIntsGetPreferredNetworkType},
+ {RIL_REQUEST_GET_PREFERRED_NETWORK_TYPE, dispatchVoid, responseInts},
{RIL_REQUEST_GET_NEIGHBORING_CELL_IDS, dispatchVoid, responseCellList},
{RIL_REQUEST_SET_LOCATION_UPDATES, dispatchInts, responseVoid},
{RIL_REQUEST_CDMA_SET_SUBSCRIPTION_SOURCE, dispatchInts, responseVoid},
@@ -150,3 +150,5 @@
{RIL_REQUEST_STOP_LCE, dispatchVoid, responseLceStatus},
{RIL_REQUEST_PULL_LCEDATA, dispatchVoid, responseLceData},
{RIL_REQUEST_GET_ACTIVITY_INFO, dispatchVoid, responseActivityData},
+ {RIL_REQUEST_SET_CARRIER_RESTRICTIONS, dispatchCarrierRestrictions, responseInts},
+ {RIL_REQUEST_GET_CARRIER_RESTRICTIONS, dispatchVoid, responseCarrierRestrictions},
diff --git a/ril/libril/ril_unsol_commands.h b/ril/libril/ril_unsol_commands.h
index eb9e12d..11ae050 100644
--- a/ril/libril/ril_unsol_commands.h
+++ b/ril/libril/ril_unsol_commands.h
@@ -60,3 +60,4 @@
{RIL_UNSOL_ON_SS, responseSSData, WAKE_PARTIAL},
{RIL_UNSOL_STK_CC_ALPHA_NOTIFY, responseString, WAKE_PARTIAL},
{RIL_UNSOL_LCEDATA_RECV, responseLceData, WAKE_PARTIAL},
+ {RIL_UNSOL_PCO_DATA, responsePcoData, WAKE_PARTIAL},