Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update Parcel readLazyValue to ignore negative object lengths

Browse Source 
Addresses a security vulnerability where a (-8) length object would
cause dataPosition to be reset back to the statt of the value, and be
re-read again.

Bug: 240138294
Test: atest ParcelTest BundleTest AmbiguousBundlesTest
Test: manually ran PoC
Change-Id: I1ab1df6f2a802d8cdf02c89c12959b09d7b1a5c4
Merged-In: I1ab1df6f2a802d8cdf02c89c12959b09d7b1a5c4
This commit is contained in:
Hani Kazmi
2022-09-27 10:19:45 +00:00
parent 2c130a95c6
commit 8e01230dd2
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
core/java/android/os/Parcel.java
View File

@@ -4388,6 +4388,9 @@ public final class Parcel {
int type = readInt(); int type = readInt();
if (isLengthPrefixed(type)) { if (isLengthPrefixed(type)) {
int objectLength = readInt(); int objectLength = readInt();
if (objectLength < 0) {
return null;
}
int end = MathUtils.addOrThrow(dataPosition(), objectLength); int end = MathUtils.addOrThrow(dataPosition(), objectLength);
int valueLength = end - start; int valueLength = end - start;
setDataPosition(end); setDataPosition(end);