Browse Source

Increment when attempting to read protected Parcel Data

Make sure to increment the parcel data position even when trying to
improperly read from protected data

Bug: 29833520

Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtection
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtectionIncrements
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtection
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtectionIncrements

Change-Id: Ie4aae6277fc5f5c924f603d9828c3a608998b986
Merged-In: Ie4aae6277fc5f5c924f603d9828c3a608998b986
(cherry picked from commit 6a825e8ad1a3928dd872bb7c3fbcd94784d77267)
replicant-6.0
Michael Wachenschwanz 2 years ago
committed by Tim Schumacher
parent
commit
7bb08cbd0c
1 changed files with 17 additions and 3 deletions
  1. +17
    -3
      libs/binder/Parcel.cpp

+ 17
- 3
libs/binder/Parcel.cpp View File

@@ -1199,7 +1199,12 @@ status_t Parcel::read(void* outData, size_t len) const
&& len <= pad_size(len)) {
if (mObjectsSize > 0) {
status_t err = validateReadData(mDataPos + pad_size(len));
if(err != NO_ERROR) return err;
if(err != NO_ERROR) {
// Still increment the data position by the expected length
mDataPos += pad_size(len);
ALOGV("read Setting data pos of %p to %zu", this, mDataPos);
return err;
}
}
memcpy(outData, mData+mDataPos, len);
mDataPos += pad_size(len);
@@ -1221,7 +1226,12 @@ const void* Parcel::readInplace(size_t len) const
&& len <= pad_size(len)) {
if (mObjectsSize > 0) {
status_t err = validateReadData(mDataPos + pad_size(len));
if(err != NO_ERROR) return NULL;
if(err != NO_ERROR) {
// Still increment the data position by the expected length
mDataPos += pad_size(len);
ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos);
return NULL;
}
}

const void* data = mData+mDataPos;
@@ -1239,7 +1249,11 @@ status_t Parcel::readAligned(T *pArg) const {
if ((mDataPos+sizeof(T)) <= mDataSize) {
if (mObjectsSize > 0) {
status_t err = validateReadData(mDataPos + sizeof(T));
if(err != NO_ERROR) return err;
if(err != NO_ERROR) {
// Still increment the data position by the expected length
mDataPos += sizeof(T);
return err;
}
}

const void* data = mData+mDataPos;


Loading…
Cancel
Save