Commit message: None
CVE: CVE-2017-0823
CWE: CWE-200
Vulnerability description: An information disclosure vulnerability in the Android system (rild). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37896655.

Project: Android

extern "C" void RIL_setcallbacks (const RIL_RadioFunctions *callbacks) {
    memcpy(&s_callbacks, callbacks, sizeof (RIL_RadioFunctions));
}

Project: Android

RIL_startEventLoop(void) {
 /* spin up eventLoop thread and wait for it to get started */
    s_started = 0;
    pthread_mutex_lock(&s_startupMutex);

 pthread_attr_t attr;
    pthread_attr_init(&attr);
    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);

 int result = pthread_create(&s_tid_dispatch, &attr, eventLoop, NULL);
 if (result != 0) {
        RLOGE("Failed to create dispatch thread: %s", strerror(result));
 goto done;
 }

 while (s_started == 0) {
        pthread_cond_wait(&s_startupCond, &s_startupMutex);
 }

done:
    pthread_mutex_unlock(&s_startupMutex);
}

Project: Android

static void dispatchCdmaSubscriptionSource(Parcel& p, RequestInfo *pRI) {
    RIL_RadioState state = CALL_ONSTATEREQUEST((RIL_SOCKET_ID)pRI->socket_id);

 if ((RADIO_STATE_UNAVAILABLE == state) || (RADIO_STATE_OFF == state)) {
        RIL_onRequestComplete(pRI, RIL_E_RADIO_NOT_AVAILABLE, NULL, 0);
 }

 if (RADIO_STATE_ON == state) {
        dispatchVoid(p, pRI);
 return;
 }

    cdmaSubscriptionSource = decodeCdmaSubscriptionSource(state);

 if (cdmaSubscriptionSource < 0)
        RIL_onRequestComplete(pRI, RIL_E_GENERIC_FAILURE, NULL, 0);
 else
        RIL_onRequestComplete(pRI, RIL_E_SUCCESS, &cdmaSubscriptionSource, sizeof(int));
}

Project: Android

static void dispatchDataProfile(Parcel &p, RequestInfo *pRI) {
 int32_t t;
 status_t status;
 int32_t num;

    status = p.readInt32(&num);
 if (status != NO_ERROR || num < 0) {
 goto invalid;
 }

 {
        RIL_DataProfileInfo *dataProfiles =
 (RIL_DataProfileInfo *)calloc(num, sizeof(RIL_DataProfileInfo));
 if (dataProfiles == NULL) {
            RLOGE("Memory allocation failed for request %s",
                    requestToString(pRI->pCI->requestNumber));
 return;
 }
        RIL_DataProfileInfo **dataProfilePtrs =
 (RIL_DataProfileInfo **)calloc(num, sizeof(RIL_DataProfileInfo *));
 if (dataProfilePtrs == NULL) {
            RLOGE("Memory allocation failed for request %s",
                    requestToString(pRI->pCI->requestNumber));
            free(dataProfiles);
 return;
 }

        startRequest;
 for (int i = 0 ; i < num ; i++ ) {
            dataProfilePtrs[i] = &dataProfiles[i];

            status = p.readInt32(&t);
            dataProfiles[i].profileId = (int) t;

            dataProfiles[i].apn = strdupReadString(p);
            dataProfiles[i].protocol = strdupReadString(p);
            status = p.readInt32(&t);
            dataProfiles[i].authType = (int) t;

            dataProfiles[i].user = strdupReadString(p);
            dataProfiles[i].password = strdupReadString(p);

            status = p.readInt32(&t);
            dataProfiles[i].type = (int) t;

            status = p.readInt32(&t);
            dataProfiles[i].maxConnsTime = (int) t;
            status = p.readInt32(&t);
            dataProfiles[i].maxConns = (int) t;
            status = p.readInt32(&t);
            dataProfiles[i].waitTime = (int) t;

            status = p.readInt32(&t);
            dataProfiles[i].enabled = (int) t;

            appendPrintBuf("%s [%d: profileId=%d, apn =%s, protocol =%s, authType =%d, \
                  user =%s, password =%s, type =%d, maxConnsTime =%d, maxConns =%d, \
                  waitTime =%d, enabled =%d]", printBuf, i, dataProfiles[i].profileId,
                  dataProfiles[i].apn, dataProfiles[i].protocol, dataProfiles[i].authType,
                  dataProfiles[i].user, dataProfiles[i].password, dataProfiles[i].type,
                  dataProfiles[i].maxConnsTime, dataProfiles[i].maxConns,
                  dataProfiles[i].waitTime, dataProfiles[i].enabled);
 }
        closeRequest;
        printRequest(pRI->token, pRI->pCI->requestNumber);

 if (status != NO_ERROR) {
            free(dataProfiles);
            free(dataProfilePtrs);
 goto invalid;
 }
        CALL_ONREQUEST(pRI->pCI->requestNumber,
                              dataProfilePtrs,
                              num * sizeof(RIL_DataProfileInfo *),
                              pRI, pRI->socket_id);

#ifdef MEMSET_FREED
        memset(dataProfiles, 0, num * sizeof(RIL_DataProfileInfo));
        memset(dataProfilePtrs, 0, num * sizeof(RIL_DataProfileInfo *));
#endif
        free(dataProfiles);
        free(dataProfilePtrs);
 }

 return;

invalid:
    invalidCommandBlock(pRI);
 return;
}

Project: Android

static void dispatchNVReadItem(Parcel &p, RequestInfo *pRI) {
    RIL_NV_ReadItem nvri;
 int32_t  t;
 status_t status;

    memset(&nvri, 0, sizeof(nvri));

    status = p.readInt32(&t);
    nvri.itemID = (RIL_NV_Item) t;

 if (status != NO_ERROR) {
 goto invalid;
 }

    startRequest;
    appendPrintBuf("%snvri.itemID=%d, ", printBuf, nvri.itemID);
    closeRequest;

    printRequest(pRI->token, pRI->pCI->requestNumber);

    CALL_ONREQUEST(pRI->pCI->requestNumber, &nvri, sizeof(nvri), pRI, pRI->socket_id);

#ifdef MEMSET_FREED
    memset(&nvri, 0, sizeof(nvri));
#endif

 return;

invalid:
    invalidCommandBlock(pRI);
 return;
}

Project: Android

static bool isDebuggable() {
 char debuggable[PROP_VALUE_MAX];
    property_get("ro.debuggable", debuggable, "0");
 if (strcmp(debuggable, "1") == 0) {
 return true;
 }
 return false;
}