From 7ac9b1da731bdf6ed2f34e22d5da7030bc0f7d21 Mon Sep 17 00:00:00 2001 From: Winson Date: Fri, 25 Jun 2021 09:59:32 -0700 Subject: [PATCH] Use IntentFilter CREATOR directly for serializing ParsedIntentInfo ParsedIntentInfo's CRFEATOR was removed because it exposes a reparcelling vulnerability. This adjusts a system API that relied on the implicit parcelling read to instead use IntentFilter directly, ignoring the fields contained in the subclass. Bug: 192050390 Bug: 191055353 Test: manual, cannot repro crash after patch Merged-In: Ib12e0a959eb5a5d73d5832ff2eee26a30eed5ded Change-Id: Ib12e0a959eb5a5d73d5832ff2eee26a30eed5ded --- .../com/android/server/pm/PackageManagerService.java | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index 8f5cf48795896..16bba9e167679 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -14226,9 +14226,15 @@ public class PackageManagerService extends IPackageManager.Stub return new ParceledListSlice(result) { @Override protected void writeElement(IntentFilter parcelable, Parcel dest, int callFlags) { - // IntentFilter has final Parcelable methods, so redirect to the subclass - ((ParsedIntentInfo) parcelable).writeIntentInfoToParcel(dest, - callFlags); + parcelable.writeToParcel(dest, callFlags); + } + + @Override + protected void writeParcelableCreator(IntentFilter parcelable, Parcel dest) { + // All Parcel#writeParcelableCreator does is serialize the class name to + // access via reflection to grab its CREATOR. This does that manually, pointing + // to the parent IntentFilter so that all of the subclass fields are ignored. + dest.writeString(IntentFilter.class.getName()); } }; }