Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file not shown.
Binary file not shown.
30 changes: 28 additions & 2 deletions app/wfbngrtl8812/src/main/cpp/WfbngLink.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,33 @@ std::string generate_random_string(size_t length) {
return result;
}

// context.getFilesDir().getAbsolutePath() -- resolved at runtime instead of
// hardcoding the package name, so both keyPath and the USB advisory lock
// directory (see run() below) keep working under a different applicationId
// or a non-default Android user profile.
static std::string resolveFilesDir(JNIEnv *env, jobject context) {
jclass contextClass = env->GetObjectClass(context);
jmethodID getFilesDirMethod = env->GetMethodID(contextClass, "getFilesDir", "()Ljava/io/File;");
jobject filesDir = env->CallObjectMethod(context, getFilesDirMethod);
Comment on lines +56 to +58

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. Library callers can hit a native crash 🐞 Bug ☼ Reliability

resolveFilesDir passes context and each returned JNI object into subsequent calls without
checking for null values or pending exceptions. A caller constructing WfbNgLink with a null
context now reaches GetObjectClass and continues through invalid JNI results, potentially aborting
initialization instead of reporting a controlled Java error.
Agent Prompt
## Issue description
The new files-directory resolver dereferences the constructor's `Context` without validating it and continues after JNI lookup or invocation failures. This can turn a null context or pending Java exception into an uncontrolled native failure.

## Issue Context
`WfbNgLink` exposes a public constructor that forwards its argument directly to `nativeInitialize`. Validate the context before native initialization and stop immediately after any JNI exception or null result, preferably by throwing a clear Java exception rather than continuing with invalid JNI values.

## Fix Focus Areas
- app/wfbngrtl8812/src/main/cpp/WfbngLink.cpp[55-66]
- app/wfbngrtl8812/src/main/java/com/openipc/wfbngrtl8812/WfbNgLink.java[53-55]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


jclass fileClass = env->GetObjectClass(filesDir);
jmethodID getAbsolutePathMethod = env->GetMethodID(fileClass, "getAbsolutePath", "()Ljava/lang/String;");
auto pathString = (jstring)env->CallObjectMethod(filesDir, getAbsolutePathMethod);

const char *pathChars = env->GetStringUTFChars(pathString, nullptr);
std::string path = std::string(pathChars);
env->ReleaseStringUTFChars(pathString, pathChars);

env->DeleteLocalRef(filesDir);
env->DeleteLocalRef(fileClass);
env->DeleteLocalRef(contextClass);
return path;
}

WfbngLink::WfbngLink(JNIEnv *env, jobject context)
: current_fd(-1), adaptive_link_enabled(true), adaptive_tx_power(30) {
filesDir = resolveFilesDir(env, context);
keyPath = filesDir + "/gs.key";
initAgg();
log = std::make_shared<Logger>(); // routes to logcat under the "devourer" tag
wifi_driver = std::make_unique<WiFiDriver>(log);
Expand Down Expand Up @@ -117,8 +142,9 @@ int WfbngLink::run(JNIEnv *env, jobject context, jint wifiChannel, jint bw, jint
// Jaguar1 (RTL8812AU) ignores it.
cfg.rx.enable_with_tx = true;
// The per-adapter advisory lock defaults to /tmp, which doesn't exist on
// Android — use the app's files dir (same location as gs.key).
cfg.usb.lock_dir = "/data/user/0/com.openipc.pixelpilot/files";
// Android — use the app's files dir (same location as gs.key, resolved in
// the constructor rather than hardcoded -- see resolveFilesDir() above).
cfg.usb.lock_dir = filesDir;
// Keep the RX ring on plain heap buffers. The zerocopy dev-mem path
// (libusb_dev_mem_alloc / USBDEVFS mmap) is unvalidated on Android vendor
// kernels; if the mmap succeeds but the HCD's zerocopy path is broken,
Expand Down
9 changes: 8 additions & 1 deletion app/wfbngrtl8812/src/main/cpp/WfbngLink.hpp
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,14 @@ class WfbngLink {
}
}

const char *keyPath = "/data/user/0/com.openipc.pixelpilot/files/gs.key";
// Resolved from the running app's own Context.getFilesDir() in the
// constructor instead of hardcoding the package name, so this keeps
// working under a different applicationId (a fork/rebrand) or a
// non-default Android user profile (secondary user, work profile,
// Samsung Secure Folder, ...), where "/data/user/0/<pkg>" isn't the
// app's actual data directory.
std::string filesDir;
std::string keyPath;
std::recursive_mutex thread_mutex;
std::unique_ptr<WiFiDriver> wifi_driver;
std::shared_ptr<TxFrame> txFrame;
Expand Down
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.