| Révision | ab1fb955acc8bbe6b9086a4ab54beab003a887a9 (tree) |
|---|---|
| l'heure | 2018-05-26 03:40:47 |
| Auteur | Michael Wachenschwanz <mwachens@goog...> |
| Commiter | android-build-team Robot |
Increment when attempting to read protected Parcel Data
Make sure to increment the parcel data position even when trying to
improperly read from protected data
Bug: 29833520
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtection
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtectionIncrements
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtection
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtectionIncrements
Change-Id: Ie4aae6277fc5f5c924f603d9828c3a608998b986
Merged-In: Ie4aae6277fc5f5c924f603d9828c3a608998b986
(cherry picked from commit 6a825e8ad1a3928dd872bb7c3fbcd94784d77267)
libs/binder/Parcel.cpp (diff)| @@ -1535,7 +1535,12 @@ status_t Parcel::read(void* outData, size_t len) const | ||
| 1535 | 1535 | && len <= pad_size(len)) { |
| 1536 | 1536 | if (mObjectsSize > 0) { |
| 1537 | 1537 | status_t err = validateReadData(mDataPos + pad_size(len)); |
| 1538 | - if(err != NO_ERROR) return err; | |
| 1538 | + if(err != NO_ERROR) { | |
| 1539 | + // Still increment the data position by the expected length | |
| 1540 | + mDataPos += pad_size(len); | |
| 1541 | + ALOGV("read Setting data pos of %p to %zu", this, mDataPos); | |
| 1542 | + return err; | |
| 1543 | + } | |
| 1539 | 1544 | } |
| 1540 | 1545 | memcpy(outData, mData+mDataPos, len); |
| 1541 | 1546 | mDataPos += pad_size(len); |
| @@ -1557,7 +1562,12 @@ const void* Parcel::readInplace(size_t len) const | ||
| 1557 | 1562 | && len <= pad_size(len)) { |
| 1558 | 1563 | if (mObjectsSize > 0) { |
| 1559 | 1564 | status_t err = validateReadData(mDataPos + pad_size(len)); |
| 1560 | - if(err != NO_ERROR) return NULL; | |
| 1565 | + if(err != NO_ERROR) { | |
| 1566 | + // Still increment the data position by the expected length | |
| 1567 | + mDataPos += pad_size(len); | |
| 1568 | + ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos); | |
| 1569 | + return NULL; | |
| 1570 | + } | |
| 1561 | 1571 | } |
| 1562 | 1572 | |
| 1563 | 1573 | const void* data = mData+mDataPos; |
| @@ -1575,7 +1585,11 @@ status_t Parcel::readAligned(T *pArg) const { | ||
| 1575 | 1585 | if ((mDataPos+sizeof(T)) <= mDataSize) { |
| 1576 | 1586 | if (mObjectsSize > 0) { |
| 1577 | 1587 | status_t err = validateReadData(mDataPos + sizeof(T)); |
| 1578 | - if(err != NO_ERROR) return err; | |
| 1588 | + if(err != NO_ERROR) { | |
| 1589 | + // Still increment the data position by the expected length | |
| 1590 | + mDataPos += sizeof(T); | |
| 1591 | + return err; | |
| 1592 | + } | |
| 1579 | 1593 | } |
| 1580 | 1594 | |
| 1581 | 1595 | const void* data = mData+mDataPos; |
Android-x86
Fork