commit 6bd352a832ce27fc93e2f3950020b4c834b33f5d
author Josh Gao <jmgao@google.com> Thu Jun 13 13:11:18 2019 -0700
committer Josh Gao <jmgao@google.com> Thu Jun 13 13:16:57 2019 -0700
tree 68b5f36e63c76c20b12fe5efd8686401efe8a1bc
parent be5600ac814fa3a9a83604a4d68e973edcae2f34

adb: turn CHECKs into an error + transport restart.

These CHECKs are expected to happen if the client does the wrong thing,
so we probably shouldn't be aborting in adbd.

Bug: http://b/133872605
Bug: http://b/134695864
Test: treehugger
Change-Id: I875b87a06ba9d399db26f8af1ad47ccf34e9445a

adb/daemon/usb.cpp

diff --git a/adb/daemon/usb.cpp b/adb/daemon/usb.cpp
index 1abae87..f4aa9fb 100644
--- a/adb/daemon/usb.cpp
+++ b/adb/daemon/usb.cpp
@@ -509,14 +509,16 @@
             }
 
             if (id.direction == TransferDirection::READ) {
-                HandleRead(id, event.res);
+                if (!HandleRead(id, event.res)) {
+                    return;
+                }
             } else {
                 HandleWrite(id);
             }
         }
     }
 
-    void HandleRead(TransferId id, int64_t size) {
+    bool HandleRead(TransferId id, int64_t size) {
         uint64_t read_idx = id.id % kUsbReadQueueDepth;
         IoBlock* block = &read_requests_[read_idx];
         block->pending = false;
@@ -526,7 +528,7 @@
         if (block->id().id != needed_read_id_) {
             LOG(VERBOSE) << "read " << block->id().id << " completed while waiting for "
                          << needed_read_id_;
-            return;
+            return true;
         }
 
         for (uint64_t id = needed_read_id_;; ++id) {
@@ -535,15 +537,22 @@
             if (current_block->pending) {
                 break;
             }
-            ProcessRead(current_block);
+            if (!ProcessRead(current_block)) {
+                return false;
+            }
             ++needed_read_id_;
         }
+
+        return true;
     }
 
-    void ProcessRead(IoBlock* block) {
+    bool ProcessRead(IoBlock* block) {
         if (!block->payload->empty()) {
             if (!incoming_header_.has_value()) {
-                CHECK_EQ(sizeof(amessage), block->payload->size());
+                if (block->payload->size() != sizeof(amessage)) {
+                    HandleError("received packet of unexpected length while reading header");
+                    return false;
+                }
                 amessage msg;
                 memcpy(&msg, block->payload->data(), sizeof(amessage));
                 LOG(DEBUG) << "USB read:" << dump_header(&msg);
@@ -551,7 +560,10 @@
             } else {
                 size_t bytes_left = incoming_header_->data_length - incoming_payload_.size();
                 Block payload = std::move(*block->payload);
-                CHECK_LE(payload.size(), bytes_left);
+                if (block->payload->size() > bytes_left) {
+                    HandleError("received too many bytes while waiting for payload");
+                    return false;
+                }
                 incoming_payload_.append(std::make_unique<Block>(std::move(payload)));
             }
 
@@ -570,6 +582,7 @@
 
         PrepareReadBlock(block, block->id().id + kUsbReadQueueDepth);
         SubmitRead(block);
+        return true;
     }
 
     bool SubmitRead(IoBlock* block) {