From ee3ca5998eb2bfe55c88025ae9929320fc6269b4 Mon Sep 17 00:00:00 2001 From: Daniele Gobbetti Date: Mon, 31 Aug 2015 17:40:46 +0200 Subject: [PATCH] Fail early when opening a pebble file. Fixes #102 We could also use a whitelist approach instead, but we can't be sure that the user installs a file with .fw extension, hence i preferred to only avoid loading files which are known to be of the wrong type. --- .../gadgetbridge/devices/miband/MiBandFWHelper.java | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/app/src/main/java/nodomain/freeyourgadget/gadgetbridge/devices/miband/MiBandFWHelper.java b/app/src/main/java/nodomain/freeyourgadget/gadgetbridge/devices/miband/MiBandFWHelper.java index 311eca0a2..2f96c7144 100644 --- a/app/src/main/java/nodomain/freeyourgadget/gadgetbridge/devices/miband/MiBandFWHelper.java +++ b/app/src/main/java/nodomain/freeyourgadget/gadgetbridge/devices/miband/MiBandFWHelper.java @@ -38,6 +38,12 @@ public class MiBandFWHelper { this.uri = uri; cr = context.getContentResolver(); + String pebblePattern = ".*\\.(pbw|pbz)"; + + if (uri.getPath().matches(pebblePattern)) { + throw new IOException("Firmware has a filename that looks like a Pebble app/firmware."); + } + try (InputStream in = new BufferedInputStream(cr.openInputStream(uri))){ this.fw = FileUtils.readAll(in, 1024 * 1024); // 1 MB if (fw.length <= firmwareVersionMajor || fw[firmwareVersionMajor] != 1) {