Code: netdutils::Status XfrmController::ipSecSetEncapSocketOwner(const android::base::unique_fd& socket,
 int newUid, uid_t callerUid) {
    ALOGD("XfrmController:%s, line=%d", __FUNCTION__, __LINE__);

 const int fd = socket.get();
 struct stat info;
 if (fstat(fd, &info)) {
 return netdutils::statusFromErrno(errno, "Failed to stat socket file descriptor");
 }
 if (info.st_uid != callerUid) {
 return netdutils::statusFromErrno(EPERM, "fchown disabled for non-owner calls");
 }
 if (S_ISSOCK(info.st_mode) == 0) {
 return netdutils::statusFromErrno(EINVAL, "File descriptor was not a socket");

     }
 
     int optval;
    socklen_t optlen;
     netdutils::Status status =
         getSyscallInstance().getsockopt(Fd(socket), IPPROTO_UDP, UDP_ENCAP, &optval, &optlen);
     if (status != netdutils::status::ok) {
 return status;
 }
 if (optval != UDP_ENCAP_ESPINUDP && optval != UDP_ENCAP_ESPINUDP_NON_IKE) {
 return netdutils::statusFromErrno(EINVAL, "Socket did not have UDP-encap sockopt set");
 }
 if (fchown(fd, newUid, -1)) {
 return netdutils::statusFromErrno(errno, "Failed to fchown socket file descriptor");
 }

 return netdutils::status::ok;
}

Vulnerability Type: DoS 
CWE ID: CWE-909
Summary: In ipSecSetEncapSocketOwner of XfrmController.cpp, there is a possible failure to initialize a security feature due to uninitialized data. This could lead to local denial of service of IPsec on sockets with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-9.0 Android ID: A-111650288
Commit Message: Set optlen for UDP-encap check in XfrmController

When setting the socket owner for an encap socket XfrmController will
first attempt to verify that the socket has the UDP-encap socket option
set. When doing so it would pass in an uninitialized optlen parameter
which could cause the call to not modify the option value if the optlen
happened to be too short. So for example if the stack happened to
contain a zero where optlen was located the check would fail and the
socket owner would not be changed.

Fix this by setting optlen to the size of the option value parameter.

Test: run cts -m CtsNetTestCases
BUG: 111650288
Change-Id: I57b6e9dba09c1acda71e3ec2084652e961667bd9
(cherry picked from commit fc42a105147310bd680952d4b71fe32974bd8506)
