From 337abb3b4e705b06f9385df063be4cc06604be04 Mon Sep 17 00:00:00 2001 From: Dianne Hackborn Date: Wed, 24 Sep 2014 12:44:29 -0700 Subject: [PATCH] Fix issue #17614141: Add protection for accessing images Add basic filename protection, also only file names that are for app icons so this can't be abused to access thumbnails. Change-Id: I2831c0f3f08a39aa734f93f76b6fd4aaf97e87c6 --- .../java/com/android/server/am/ActivityManagerService.java | 4 ++++ services/core/java/com/android/server/am/ActivityRecord.java | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java index 993b9952666b3..e26ef1a08e455 100755 --- a/services/core/java/com/android/server/am/ActivityManagerService.java +++ b/services/core/java/com/android/server/am/ActivityManagerService.java @@ -8386,6 +8386,10 @@ public final class ActivityManagerService extends ActivityManagerNative @Override public Bitmap getTaskDescriptionIcon(String filename) { + if (!FileUtils.isValidExtFilename(filename) + || !filename.contains(ActivityRecord.ACTIVITY_ICON_SUFFIX)) { + throw new IllegalArgumentException("Bad filename: " + filename); + } return mTaskPersister.getTaskDescriptionIcon(filename); } diff --git a/services/core/java/com/android/server/am/ActivityRecord.java b/services/core/java/com/android/server/am/ActivityRecord.java index 2db7cec611399..198273e8fd800 100755 --- a/services/core/java/com/android/server/am/ActivityRecord.java +++ b/services/core/java/com/android/server/am/ActivityRecord.java @@ -79,7 +79,7 @@ final class ActivityRecord { private static final String ATTR_LAUNCHEDFROMPACKAGE = "launched_from_package"; private static final String ATTR_RESOLVEDTYPE = "resolved_type"; private static final String ATTR_COMPONENTSPECIFIED = "component_specified"; - private static final String ACTIVITY_ICON_SUFFIX = "_activity_icon_"; + static final String ACTIVITY_ICON_SUFFIX = "_activity_icon_"; final ActivityManagerService service; // owner final IApplicationToken.Stub appToken; // window manager token