diff --git a/core/java/android/content/pm/PackageInstaller.java b/core/java/android/content/pm/PackageInstaller.java
index 0fc9fad4d635e..0dcfd38294b93 100644
--- a/core/java/android/content/pm/PackageInstaller.java
+++ b/core/java/android/content/pm/PackageInstaller.java
@@ -1227,6 +1227,7 @@ public class PackageInstaller {
          *                  {@link PackageManager#requestChecksums}.
          * @throws SecurityException if called after the session has been
          *                           committed or abandoned.
+         * @throws IllegalStateException if checksums for this file have already been added.
          * @deprecated  do not use installer-provided checksums,
          *              use platform-enforced checksums
          *              e.g. {@link Checksum#TYPE_WHOLE_MERKLE_ROOT_4K_SHA256}
diff --git a/services/core/java/com/android/server/pm/PackageInstallerSession.java b/services/core/java/com/android/server/pm/PackageInstallerSession.java
index ef947d8c96351..d95ab55085b90 100644
--- a/services/core/java/com/android/server/pm/PackageInstallerSession.java
+++ b/services/core/java/com/android/server/pm/PackageInstallerSession.java
@@ -991,12 +991,14 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub {
             assertCallerIsOwnerOrRootLocked();
             assertPreparedAndNotCommittedOrDestroyedLocked("addChecksums");
 
+            if (mChecksums.containsKey(name)) {
+                throw new IllegalStateException("Duplicate checksums.");
+            }
+
+            List<CertifiedChecksum> fileChecksums = new ArrayList<>();
+            mChecksums.put(name, fileChecksums);
+
             for (Checksum checksum : checksums) {
-                List<CertifiedChecksum> fileChecksums = mChecksums.get(name);
-                if (fileChecksums == null) {
-                    fileChecksums = new ArrayList<>();
-                    mChecksums.put(name, fileChecksums);
-                }
                 fileChecksums.add(new CertifiedChecksum(checksum, initiatingPackageName,
                         mainCertificateBytes));
             }