From 3534daddeefefbd42ea0a3819348327e5d85315c Mon Sep 17 00:00:00 2001 From: Scott Main Date: Wed, 28 Oct 2009 09:50:06 -0700 Subject: [PATCH 1/3] docs: fix XSS vulnerability in search add a function that uses replace() to replace all instances of '<' and '>' with the HTML entities and use this wherever the query text is added onto the page. --- docs/html/search.jd | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/docs/html/search.jd b/docs/html/search.jd index 8032b22191675..d0e7478b51eb7 100644 --- a/docs/html/search.jd +++ b/docs/html/search.jd @@ -70,8 +70,8 @@ page.title=Search Results searchControl.setSearchStartingCallback(this, function(control, searcher, query) { // save the tab index from the hash tabIndex = location.hash.split("&t=")[1]; - - $("#searchTitle").html("search results for " + query + ""); + + $("#searchTitle").html("search results for " + escapeHTML(query) + ""); $.history.add('q=' + query + '&t=' + tabIndex); openTab(); }); @@ -96,7 +96,8 @@ page.title=Search Results $(window).history(function(e, hash) { var query = decodeURI(getQuery(hash)); searchControl.execute(query); - $("#searchTitle").html("search results for " + query + ""); + + $("#searchTitle").html("search results for " + escapeHTML(query) + ""); }); // forcefully regain key-up event control (previously jacked by search api) @@ -131,6 +132,13 @@ page.title=Search Results return queryParts[1]; } + /* returns the given string with all HTML brackets converted to entities + TODO: move this to the site's JS library */ + function escapeHTML(string) { + return string.replace(//g,">"); + } +
From 4cb04c4654e9718a73b378e7b9962dee454efa8d Mon Sep 17 00:00:00 2001 From: Wu-cheng Li Date: Fri, 23 Oct 2009 17:39:46 +0800 Subject: [PATCH 2/3] Use image rect information to display zoomed picture. --- camera/libcameraservice/CameraService.cpp | 20 +++++++++++++++++--- camera/libcameraservice/CameraService.h | 2 +- include/ui/CameraHardwareInterface.h | 9 +++++++++ 3 files changed, 27 insertions(+), 4 deletions(-) diff --git a/camera/libcameraservice/CameraService.cpp b/camera/libcameraservice/CameraService.cpp index 688014430c13e..29531ca7840c2 100644 --- a/camera/libcameraservice/CameraService.cpp +++ b/camera/libcameraservice/CameraService.cpp @@ -865,7 +865,11 @@ status_t CameraService::Client::takePicture() } // snapshot taken -void CameraService::Client::handleShutter() +void CameraService::Client::handleShutter( + image_rect_type *size // The width and height of yuv picture for + // registerBuffer. If this is NULL, use the picture + // size from parameters. +) { // Play shutter sound. if (mMediaPlayerClick.get() != NULL) { @@ -889,12 +893,21 @@ void CameraService::Client::handleShutter() if (mSurface != 0 && !mUseOverlay) { int w, h; CameraParameters params(mHardware->getParameters()); - params.getPictureSize(&w, &h); uint32_t transform = 0; if (params.getOrientation() == CameraParameters::CAMERA_ORIENTATION_PORTRAIT) { LOGV("portrait mode"); transform = ISurface::BufferHeap::ROT_90; } + + if (size == NULL) { + params.getPictureSize(&w, &h); + } else { + w = size->width; + h = size->height; + w &= ~1; + h &= ~1; + LOGD("Snapshot image width=%d, height=%d", w, h); + } ISurface::BufferHeap buffers(w, h, w, h, PIXEL_FORMAT_YCbCr_420_SP, transform, 0, mHardware->getRawHeap()); @@ -1048,7 +1061,8 @@ void CameraService::Client::notifyCallback(int32_t msgType, int32_t ext1, int32_ switch (msgType) { case CAMERA_MSG_SHUTTER: - client->handleShutter(); + // ext1 is the dimension of the yuv picture. + client->handleShutter((image_rect_type *)ext1); break; default: sp c = client->mCameraClient; diff --git a/camera/libcameraservice/CameraService.h b/camera/libcameraservice/CameraService.h index 2fcf839064b28..41c5d99faaaaf 100644 --- a/camera/libcameraservice/CameraService.h +++ b/camera/libcameraservice/CameraService.h @@ -145,7 +145,7 @@ private: static sp getClientFromCookie(void* user); void handlePreviewData(const sp&); - void handleShutter(); + void handleShutter(image_rect_type *image); void handlePostview(const sp&); void handleRawPicture(const sp&); void handleCompressedPicture(const sp&); diff --git a/include/ui/CameraHardwareInterface.h b/include/ui/CameraHardwareInterface.h index af40f31ed19a8..240c1348a35ef 100644 --- a/include/ui/CameraHardwareInterface.h +++ b/include/ui/CameraHardwareInterface.h @@ -25,6 +25,15 @@ #include namespace android { +/** + * The size of image for display. + */ +typedef struct image_rect_struct +{ + uint32_t width; /* Image width */ + uint32_t height; /* Image height */ +} image_rect_type; + typedef void (*notify_callback)(int32_t msgType, int32_t ext1, From d83006cbe86545a1e8882b1a4ed90005ebf3423e Mon Sep 17 00:00:00 2001 From: Suchi Amalapurapu Date: Wed, 28 Oct 2009 23:39:46 -0700 Subject: [PATCH 3/3] When upgrading packages with shared user ids make sure we are eliminating the package about to be deleted or upgraded when updating permissions associated with the shared user. Include a simple null check when retrieving the permission. Fix PackageParser to avoid ArrayIndexOutOfBounds exceptions in several places --- .../android/content/pm/PackageParser.java | 26 +++++++++---------- .../android/server/PackageManagerService.java | 8 ++++-- 2 files changed, 18 insertions(+), 16 deletions(-) diff --git a/core/java/android/content/pm/PackageParser.java b/core/java/android/content/pm/PackageParser.java index 54015c970bb4b..b798bde023386 100644 --- a/core/java/android/content/pm/PackageParser.java +++ b/core/java/android/content/pm/PackageParser.java @@ -201,11 +201,11 @@ public class PackageParser { } pi.activities = new ActivityInfo[num]; } - for (int i=0; i 0) { - pi.signatures = new Signature[N]; - System.arraycopy(p.mSignatures, 0, pi.signatures, 0, N); - } + int N = (p.mSignatures != null) ? p.mSignatures.length : 0; + if (N > 0) { + pi.signatures = new Signature[N]; + System.arraycopy(p.mSignatures, 0, pi.signatures, 0, N); } } return pi; diff --git a/services/java/com/android/server/PackageManagerService.java b/services/java/com/android/server/PackageManagerService.java index 5f30b3d45b482..a83459edaba56 100644 --- a/services/java/com/android/server/PackageManagerService.java +++ b/services/java/com/android/server/PackageManagerService.java @@ -6344,7 +6344,9 @@ class PackageManagerService extends IPackageManager.Stub { continue; } for (PackageSetting pkg:sus.packages) { - if (pkg.pkg.requestedPermissions.contains(eachPerm)) { + if (pkg.pkg != null && + !pkg.pkg.packageName.equalsIgnoreCase(deletedPs.pkg.packageName) && + pkg.pkg.requestedPermissions.contains(eachPerm)) { used = true; break; } @@ -6359,7 +6361,9 @@ class PackageManagerService extends IPackageManager.Stub { int newGids[] = globalGids; for (String eachPerm : sus.grantedPermissions) { BasePermission bp = mPermissions.get(eachPerm); - newGids = appendInts(newGids, bp.gids); + if (bp != null) { + newGids = appendInts(newGids, bp.gids); + } } sus.gids = newGids; }