ADHOC/replicant-frameworks_native
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Increment when attempting to read protected Parcel Data

Browse Source 
Make sure to increment the parcel data position even when trying to
improperly read from protected data

Bug: 29833520

Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtection
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtectionIncrements
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtection
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtectionIncrements

Change-Id: Ie4aae6277fc5f5c924f603d9828c3a608998b986
Merged-In: Ie4aae6277fc5f5c924f603d9828c3a608998b986
(cherry picked from commit 6a825e8ad1a3928dd872bb7c3fbcd94784d77267)
This commit is contained in:
Michael Wachenschwanz 2018-04-17 16:52:40 -07:00 committed by Tim Schumacher
parent d53a5c4aa9
commit 7bb08cbd0c
1 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
libs/binder/Parcel.cpp
View File

@ -1199,7 +1199,12 @@ status_t Parcel::read(void* outData, size_t len) const
&& len <= pad_size(len)) { && len <= pad_size(len)) {
if (mObjectsSize > 0) { if (mObjectsSize > 0) {
status_t err = validateReadData(mDataPos + pad_size(len)); status_t err = validateReadData(mDataPos + pad_size(len));
if(err != NO_ERROR) return err; if(err != NO_ERROR) {
// Still increment the data position by the expected length
mDataPos += pad_size(len);
ALOGV("read Setting data pos of %p to %zu", this, mDataPos);
return err;
}
} }
memcpy(outData, mData+mDataPos, len); memcpy(outData, mData+mDataPos, len);
mDataPos += pad_size(len); mDataPos += pad_size(len);
@ -1221,7 +1226,12 @@ const void* Parcel::readInplace(size_t len) const
&& len <= pad_size(len)) { && len <= pad_size(len)) {
if (mObjectsSize > 0) { if (mObjectsSize > 0) {
status_t err = validateReadData(mDataPos + pad_size(len)); status_t err = validateReadData(mDataPos + pad_size(len));
if(err != NO_ERROR) return NULL; if(err != NO_ERROR) {
// Still increment the data position by the expected length
mDataPos += pad_size(len);
ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos);
return NULL;
}
} }
const void* data = mData+mDataPos; const void* data = mData+mDataPos;
@ -1239,7 +1249,11 @@ status_t Parcel::readAligned(T *pArg) const {
if ((mDataPos+sizeof(T)) <= mDataSize) { if ((mDataPos+sizeof(T)) <= mDataSize) {
if (mObjectsSize > 0) { if (mObjectsSize > 0) {
status_t err = validateReadData(mDataPos + sizeof(T)); status_t err = validateReadData(mDataPos + sizeof(T));
if(err != NO_ERROR) return err; if(err != NO_ERROR) {
// Still increment the data position by the expected length
mDataPos += sizeof(T);
return err;
}
} }
const void* data = mData+mDataPos; const void* data = mData+mDataPos;