From 373a01c3ad88c0e4da897efd383eb5d7e2912b1f Mon Sep 17 00:00:00 2001 From: Alex Buynytskyy Date: Mon, 16 Nov 2020 17:55:35 -0800 Subject: [PATCH] Detect duplicate addChecksums calls. Bug: 160605420 Test: atest ChecksumsTest Change-Id: I1a56865b0b27845494a337bd1d8fb49ca346af2f --- core/java/android/content/pm/PackageInstaller.java | 1 + .../android/server/pm/PackageInstallerSession.java | 12 +++++++----- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/core/java/android/content/pm/PackageInstaller.java b/core/java/android/content/pm/PackageInstaller.java index 0fc9fad4d635e..0dcfd38294b93 100644 --- a/core/java/android/content/pm/PackageInstaller.java +++ b/core/java/android/content/pm/PackageInstaller.java @@ -1227,6 +1227,7 @@ public class PackageInstaller { * {@link PackageManager#requestChecksums}. * @throws SecurityException if called after the session has been * committed or abandoned. + * @throws IllegalStateException if checksums for this file have already been added. * @deprecated do not use installer-provided checksums, * use platform-enforced checksums * e.g. {@link Checksum#TYPE_WHOLE_MERKLE_ROOT_4K_SHA256} diff --git a/services/core/java/com/android/server/pm/PackageInstallerSession.java b/services/core/java/com/android/server/pm/PackageInstallerSession.java index ef947d8c96351..d95ab55085b90 100644 --- a/services/core/java/com/android/server/pm/PackageInstallerSession.java +++ b/services/core/java/com/android/server/pm/PackageInstallerSession.java @@ -991,12 +991,14 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub { assertCallerIsOwnerOrRootLocked(); assertPreparedAndNotCommittedOrDestroyedLocked("addChecksums"); + if (mChecksums.containsKey(name)) { + throw new IllegalStateException("Duplicate checksums."); + } + + List fileChecksums = new ArrayList<>(); + mChecksums.put(name, fileChecksums); + for (Checksum checksum : checksums) { - List fileChecksums = mChecksums.get(name); - if (fileChecksums == null) { - fileChecksums = new ArrayList<>(); - mChecksums.put(name, fileChecksums); - } fileChecksums.add(new CertifiedChecksum(checksum, initiatingPackageName, mainCertificateBytes)); }