frameworks/native
Révision | ab1fb955acc8bbe6b9086a4ab54beab003a887a9 (tree) |
---|---|
l'heure | 2018-05-26 03:40:47 |
Auteur | Michael Wachenschwanz <mwachens@goog...> |
Commiter | android-build-team Robot |
Increment when attempting to read protected Parcel Data
Make sure to increment the parcel data position even when trying to
improperly read from protected data
Bug: 29833520
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtection
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtectionIncrements
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtection
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtectionIncrements
Change-Id: Ie4aae6277fc5f5c924f603d9828c3a608998b986
Merged-In: Ie4aae6277fc5f5c924f603d9828c3a608998b986
(cherry picked from commit 6a825e8ad1a3928dd872bb7c3fbcd94784d77267)
@@ -1535,7 +1535,12 @@ status_t Parcel::read(void* outData, size_t len) const | ||
1535 | 1535 | && len <= pad_size(len)) { |
1536 | 1536 | if (mObjectsSize > 0) { |
1537 | 1537 | status_t err = validateReadData(mDataPos + pad_size(len)); |
1538 | - if(err != NO_ERROR) return err; | |
1538 | + if(err != NO_ERROR) { | |
1539 | + // Still increment the data position by the expected length | |
1540 | + mDataPos += pad_size(len); | |
1541 | + ALOGV("read Setting data pos of %p to %zu", this, mDataPos); | |
1542 | + return err; | |
1543 | + } | |
1539 | 1544 | } |
1540 | 1545 | memcpy(outData, mData+mDataPos, len); |
1541 | 1546 | mDataPos += pad_size(len); |
@@ -1557,7 +1562,12 @@ const void* Parcel::readInplace(size_t len) const | ||
1557 | 1562 | && len <= pad_size(len)) { |
1558 | 1563 | if (mObjectsSize > 0) { |
1559 | 1564 | status_t err = validateReadData(mDataPos + pad_size(len)); |
1560 | - if(err != NO_ERROR) return NULL; | |
1565 | + if(err != NO_ERROR) { | |
1566 | + // Still increment the data position by the expected length | |
1567 | + mDataPos += pad_size(len); | |
1568 | + ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos); | |
1569 | + return NULL; | |
1570 | + } | |
1561 | 1571 | } |
1562 | 1572 | |
1563 | 1573 | const void* data = mData+mDataPos; |
@@ -1575,7 +1585,11 @@ status_t Parcel::readAligned(T *pArg) const { | ||
1575 | 1585 | if ((mDataPos+sizeof(T)) <= mDataSize) { |
1576 | 1586 | if (mObjectsSize > 0) { |
1577 | 1587 | status_t err = validateReadData(mDataPos + sizeof(T)); |
1578 | - if(err != NO_ERROR) return err; | |
1588 | + if(err != NO_ERROR) { | |
1589 | + // Still increment the data position by the expected length | |
1590 | + mDataPos += sizeof(T); | |
1591 | + return err; | |
1592 | + } | |
1579 | 1593 | } |
1580 | 1594 | |
1581 | 1595 | const void* data = mData+mDataPos; |