Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Resolve custom printer icon boundary exploit." into sc-dev

Browse Source
This commit is contained in:
Treehugger Robot
2023-07-31 22:08:06 +00:00
committed by Android (Google) Code Review
parent ddc2eb9d24 0e0693ca9c
commit 5f83b3051b
1 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
services/print/java/com/android/server/print/PrintManagerService.java
View File

@@ -254,12 +254,45 @@ public final class PrintManagerService extends SystemService {
}
final long identity = Binder.clearCallingIdentity();
try {
return userState.getCustomPrinterIcon(printerId);
Icon icon = userState.getCustomPrinterIcon(printerId);
return validateIconUserBoundary(icon);
} finally {
Binder.restoreCallingIdentity(identity);
}
}
/**
* Validates the custom printer icon to see if it's not in the calling user space.
* If the condition is not met, return null. Otherwise, return the original icon.
*
* @param icon
* @return icon (validated)
*/
private Icon validateIconUserBoundary(Icon icon) {
// Refer to Icon#getUriString for context. The URI string is invalid for icons of
// incompatible types.
if (icon != null && (icon.getType() == Icon.TYPE_URI
|| icon.getType() == Icon.TYPE_URI_ADAPTIVE_BITMAP)) {
String encodedUser = icon.getUri().getEncodedUserInfo();
// If there is no encoded user, the URI is calling into the calling user space
if (encodedUser != null) {
int userId = Integer.parseInt(encodedUser);
// resolve encoded user
final int resolvedUserId = resolveCallingUserEnforcingPermissions(userId);
synchronized (mLock) {
// Only the current group members can get the printer icons.
if (resolveCallingProfileParentLocked(resolvedUserId)
!= getCurrentUserId()) {
return null;
}
}
}
}
return icon;
}
@Override
public void cancelPrintJob(PrintJobId printJobId, int appId, int userId) {
if (printJobId == null) {