Revise the IllegalArgumentException check

Combining the two IllegalArgumentException check in getSigningKeySet
to mitigate the potential information leakage.

Bug: 189857801
Test: atest PackageManagerTests
Test: manually using the PoC in the buganizer to ensure the symptom
      no longer exists.
Change-Id: Ieaedb7305300a96a83f99895435c9577351831b9
This commit is contained in:
Jackal Guo
2021-06-15 14:53:44 +08:00
parent 96d2926fc7
commit 5228b4cf3a

View File

@@ -26445,14 +26445,10 @@ public class PackageManagerService extends IPackageManager.Stub
final int callingUid = Binder.getCallingUid();
final int callingUserId = UserHandle.getUserId(callingUid);
final AndroidPackage pkg = mPackages.get(packageName);
if (pkg == null) {
Slog.w(TAG, "KeySet requested for unknown package: " + packageName);
throw new IllegalArgumentException("Unknown package: " + packageName);
}
final PackageSetting ps = getPackageSetting(pkg.getPackageName());
if (shouldFilterApplicationLocked(ps, callingUid, callingUserId)) {
// filter and pretend the package doesn't exist
Slog.w(TAG, "KeySet requested for filtered package: " + packageName
if (pkg == null
|| shouldFilterApplicationLocked(getPackageSetting(pkg.getPackageName()),
callingUid, callingUserId)) {
Slog.w(TAG, "KeySet requested for unknown package: " + packageName
+ ", uid:" + callingUid);
throw new IllegalArgumentException("Unknown package: " + packageName);
}