commit 597a990e91993878ead01a3ec7f709d294e8f1e2
author Tomasz Wasilczyk <twasilczyk@google.com> Fri Aug 02 00:56:33 2024 -0700
committer Tomasz Wasilczyk <twasilczyk@google.com> Fri Aug 02 00:59:33 2024 -0700
tree 386dce1e5bf4354974445f3133ecf0e3a3d02966
parent 808b8d14116ca4ef3f7ac98984b91ed2ecafd2d8

Fix range check when encoding FPLMNs

Bug: 353979854
Test: atest CtsTelephonyTestCases:android.telephony.cts.TelephonyManagerTest
Flag: EXEMPT bugfix
Change-Id: Ic79c442e08a0c89809e92ad710a3a2ffde7ef46d

telephony/java/com/android/internal/telephony/uicc/IccUtils.java

diff --git a/telephony/java/com/android/internal/telephony/uicc/IccUtils.java b/telephony/java/com/android/internal/telephony/uicc/IccUtils.java
index f518d53..9676bd7 100644
--- a/telephony/java/com/android/internal/telephony/uicc/IccUtils.java
+++ b/telephony/java/com/android/internal/telephony/uicc/IccUtils.java
@@ -967,7 +967,7 @@
         byte[] serializedFplmns = new byte[dataLength];
         int offset = 0;
         for (String fplmn : fplmns) {
-            if (offset >= dataLength) break;
+            if (offset + FPLMN_BYTE_SIZE > dataLength) break;
             stringToBcdPlmn(fplmn, serializedFplmns, offset);
             offset += FPLMN_BYTE_SIZE;
         }