CVE-2024-40650 AI-generated analysis
platform/packages/apps/Settings, Wi-Fi network configuration UI resources (res/values/styles.xml, style wifi_item_edit_content)
Adds android:maxLength=500 to the wifi_item_edit_content style in Settings res/values/styles.xml, so edit fields using that style (the commit tests it on "Add network") accept at most 500 characters.
Root cause
The wifi_item_edit_content style declared padding, layout margin, text alignment, text appearance, hint color and minHeight, but no android:maxLength. Edit fields using this style therefore had no length limit at the UI layer. The style name and the commit's test note ("Add network") tie it to the Wi-Fi network configuration UI. The bulletin rates the issue High / EoP. The material does not show the code that consumes the field values or how an oversized value leads to the issue.
How the fix works
- res/values/styles.xml, style wifi_item_edit_content: adds <item name="android:maxLength">500</item>. Every text view using this style now has its content capped at 500 characters (android:maxLength installs an InputFilter.LengthFilter on the TextView (general platform knowledge)).
- This is a single one-line resource change. The commit adds no Java logic and no new validation.
Completeness
- Covers only views that use the wifi_item_edit_content style. Edit fields that use a different style or set their attributes inline are not touched by this diff.
- The neighbouring styles wifi_item_content, wifi_item_spinner and wifi_advanced_toggle in the same file are unchanged. The material does not show which views use them.
- The fix is a UI-layer length cap. It adds no length validation in the code that consumes the field values. The material does not show whether other entry points to that code exist.
Behavior changes
- Users can no longer enter more than 500 characters into any field styled with wifi_item_edit_content. Extra input is dropped by the length filter (general platform knowledge).
Per major
- Android 14: same fix: 2968ccc91195 (a cherry-pick of 855053ca4124) landed in android-security-14.0.0_r12. At android-security-14.0.0_r29, 4/4 lines of the patched region are present (the maxLength item is at styles.xml line 124).
- Android 15: same fix: commit 092668676af7 is in the android-15.0.0_r1 base. At android-security-15.0.0_r17, 4/4 lines of the patched region are present.
- Android 16: not affected (not listed by the bulletin). The patched region is present at android-security-16.0.0_r8 (4/4 lines).
- Android 17: not affected (not listed by the bulletin). At android-security-17.0.0_r1, 3/4 lines of the patched region are present. The material does not show which line differs.
Unknowns
- Which layouts or EditTexts reference wifi_item_edit_content, and which code consumed the oversized value. The material shows only the style definition.
- Why the bulletin classifies the issue as EoP. The diff alone does not show the mechanism.
- Whether and how the fix was applied to Android 12, 12L and 13, which the bulletin lists as affected. No per-major facts are given for them.
- Which of the 4 patched-region lines differs on Android 17 (android-security-17.0.0_r1), and why.