From 81f532c9a0553f2a2a506eaeae0a0c7db7cfa018 Mon Sep 17 00:00:00 2001
From: Miguel <miguelaranda@google.com>
Date: Wed, 11 Jan 2023 16:44:06 +0000
Subject: [PATCH] Only use concscrypt certs if directory is nonempty

Test: atest TrustedCertificateStoreTest
Bug: 264540110
Change-Id: I5ac47315d3e9cfacb53d27080046a3fd8cfb7878
---
 .../android/security/net/config/SystemCertificateSource.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/java/android/security/net/config/SystemCertificateSource.java b/core/java/android/security/net/config/SystemCertificateSource.java
index 48923126117a2..13f7e5d4232b8 100644
--- a/core/java/android/security/net/config/SystemCertificateSource.java
+++ b/core/java/android/security/net/config/SystemCertificateSource.java
@@ -41,7 +41,7 @@ public final class SystemCertificateSource extends DirectoryCertificateSource {
     private static File getDirectory() {
         // TODO(miguelaranda): figure out correct code path.
         File updatable_dir = new File("/apex/com.android.conscrypt/cacerts");
-        if (updatable_dir.exists()) {
+        if (updatable_dir.exists() && !(updatable_dir.list().length == 0)) {
             return updatable_dir;
         }
         return new File(System.getenv("ANDROID_ROOT") + "/etc/security/cacerts");