From 80d0f4c66bc4b64e0f3cd1fe6a12db09705b9c4d Mon Sep 17 00:00:00 2001
From: Yurii Zubrytskyi <zyy@google.com>
Date: Fri, 26 Feb 2021 03:53:04 -0500
Subject: [PATCH] [hardening] Switch to hardened libziparchive in system_server

Use the new libziparchive_hardened in all system_server
dependencies to ensure no missing page access can crash
the process

Bug: 160635079
Test: IncrementalService tests + adb install --incremental
Change-Id: I1c664e111b69718cd9c62fc3e0d6a5dc70bed16b
---
 core/jni/Android.bp             | 3 +--
 libs/androidfw/Android.bp       | 2 +-
 libs/hwui/Android.bp            | 3 +--
 services/incremental/Android.bp | 2 +-
 4 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/core/jni/Android.bp b/core/jni/Android.bp
index d6d33873adaae..078511c636ade 100644
--- a/core/jni/Android.bp
+++ b/core/jni/Android.bp
@@ -69,10 +69,9 @@ cc_library_shared {
         "liblog",
         "libminikin",
         "libz",
-        "libziparchive",
     ],
 
-    static_libs: ["libnativehelper_lazy"],
+    static_libs: ["libnativehelper_lazy", "libziparchive_for_incfs", ],
 
     export_include_dirs: [
         ".",
diff --git a/libs/androidfw/Android.bp b/libs/androidfw/Android.bp
index aba0f1b476733..63b831de5da17 100644
--- a/libs/androidfw/Android.bp
+++ b/libs/androidfw/Android.bp
@@ -97,8 +97,8 @@ cc_library {
                 "libincfs",
                 "libutils",
                 "libz",
-                "libziparchive",
             ],
+            static_libs: ["libziparchive_for_incfs"],
             static: {
                 enabled: false,
             },
diff --git a/libs/hwui/Android.bp b/libs/hwui/Android.bp
index d663c52b2c084..607ef72df96af 100644
--- a/libs/hwui/Android.bp
+++ b/libs/hwui/Android.bp
@@ -388,11 +388,10 @@ cc_defaults {
         "liblog",
         "libminikin",
         "libz",
-        "libziparchive",
         "libjpeg",
     ],
 
-    static_libs: ["libnativehelper_lazy"],
+    static_libs: ["libnativehelper_lazy", "libziparchive_for_incfs"],
 
     target: {
         android: {
diff --git a/services/incremental/Android.bp b/services/incremental/Android.bp
index 5ffbd771764d0..5140b9f6db581 100644
--- a/services/incremental/Android.bp
+++ b/services/incremental/Android.bp
@@ -68,6 +68,7 @@ cc_defaults {
         "libutils",
         "libvold_binder",
         "libc++fs",
+        "libziparchive_for_incfs",
     ],
     shared_libs: [
         "libandroidfw",
@@ -77,7 +78,6 @@ cc_defaults {
         "libincfs",
         "liblog",
         "libz",
-        "libziparchive",
     ],
 }