Getting “ssid bytes size out of range” error on Android 10 if WiFi is enabled

Question

I have OnePlus 7 Pro that got updated to Android 10. Since then, the phone randomly reboots. It seems it's related to WiFi since the random reboots almost never happen when WiFi is turned off (regardless if it's actually connected to a network or not)

Logcat:

Error: AndroidRuntime

*** FATAL EXCEPTION IN SYSTEM PROCESS: ClientModeImpl
java.lang.IllegalArgumentException: ssid bytes size out of range: 64
    at com.android.server.wifi.util.NativeUtil.decodeSsid(NativeUtil.java:278)
    at com.android.server.wifi.WifiScoreCard.computeHashLong(WifiScoreCard.java:588)
    at com.android.server.wifi.WifiScoreCard.access$100(WifiScoreCard.java:63)
    at com.android.server.wifi.WifiScoreCard$PerBssid.<init>(WifiScoreCard.java:380)
    at com.android.server.wifi.WifiScoreCard.lookupBssid(WifiScoreCard.java:530)
    at com.android.server.wifi.WifiCandidates.add(WifiCandidates.java:374)
    at com.android.server.wifi.WifiCandidates.add(WifiCandidates.java:393)
    at com.android.server.wifi.WifiNetworkSelector.lambda$selectNetwork$0$WifiNetworkSelector(WifiNetworkSelector.java:911)
    at com.android.server.wifi.-$$Lambda$WifiNetworkSelector$Z7htivbXF5AzGeTh0ZNbtUXC_0Q.onConnectable(Unknown Source:15)
    at com.android.server.wifi.SavedNetworkEvaluator.evaluateNetworks(SavedNetworkEvaluator.java:279)
    at com.android.server.wifi.WifiNetworkSelector.selectNetwork(WifiNetworkSelector.java:900)
    at com.android.server.wifi.WifiConnectivityManager.handleScanResults(WifiConnectivityManager.java:342)
    at com.android.server.wifi.WifiConnectivityManager.access$900(WifiConnectivityManager.java:73)
    at com.android.server.wifi.WifiConnectivityManager$AllSingleScanListener.onResults(WifiConnectivityManager.java:425)
    at android.net.wifi.WifiScanner$ServiceHandler.handleMessage(WifiScanner.java:1429)
    at android.os.Handler.dispatchMessage(Handler.java:107)
    at android.os.Looper.loop(Looper.java:214)
    at android.os.HandlerThread.run(HandlerThread.java:67)

PID: 28683
TID: 28862


The following error message says:

FATAL EXCEPTION: main
Process: com.google.android.gms.persistent, PID: 30417
DeadSystemException: The system died; earlier logs will point to the root cause

This is consistent and the same exact error shows up every time the system crashes/reboots.

Why, and how to fix this issue?

Answer 1

The error message is caused by SSIDs containing more than 32 bytes.

According to the Wikipedia,

Unlike basic service set identifiers, SSIDs are usually customizable. These SSIDs can be zero to 32 octets (32 bytes) long, and are, for convenience, usually in a natural language, such as English. The 802.11 standards prior to the 2012 edition did not define any particular encoding/representation for SSIDs, which were expected to be treated and handled as an arbitrary sequence of 0–32 octets that are not limited to printable characters. The IEEE 802.11-2012 defines a tag that the SSID is UTF-8 encoded and when interpreting could contain any non-ISO basic Latin characters within it. Wireless network stacks must still be prepared to handle arbitrary values in the SSID field.

Note that the limitation is 32 bytes, not 32 characters. While each character in ASCII encoding is 1 byte, characters in UTF-8 encoding can take up to 4 bytes. Example:

1. Test consisted of 4 characters and 4 bytes.
2. テスト consisted of 3 characters but 9 bytes.

If the offending SSIDs are in your control, then the simple fix is by reducing their byte size (length).

---

The check on the Android-side that produces this error message was added on April 2019, which is between Android 9 (August 2018) and Android 10 (September 2019).

NativeUtil: Perform range checks on ssid bytes size

NativeUtil.encodeSsid/decodeSsid should perform range checks because the output/input is coming from binder/hwbinder interfaces which assume the ssid is not malformed (i.e within spec mandated size range).

Most of the callers of these methods already handle IllegalArgumentException (including the hidden network list built in WifiCondControl). This should fix the reported issue of a hidden SSID added with size > 32 causing crash in wificond.