From b0d5aea9b17c2fe2343c709f5d25852510258237 Mon Sep 17 00:00:00 2001 From: William Loh Date: Fri, 5 Aug 2022 20:25:27 +0000 Subject: [PATCH] Limit length and number of MIME types you can set Limit character length of MIME types to 255. If this length is exceeded then a IllegalArugmentException is thrown. The number of MIME types that can be set is also limited to 500 per MIME group with the number of total MIME Groups also limited to 500. A IllegalStateException is thrown if this number is exceeded. Bug: 237291548 Test: Installed and ran POC app from b/237291548 Change-Id: I1d57e674f778cfacdc89225ac3273c432a39af63 --- .../com/android/server/pm/PackageManagerService.java | 9 +++++++++ .../com/android/server/pm/parsing/pkg/PackageImpl.java | 3 +++ 2 files changed, 12 insertions(+) diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index 5ad39f226879e..752ebf330abe3 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -5801,6 +5801,11 @@ public class PackageManagerService implements PackageSender, TestUtilityService final Computer snapshot = snapshotComputer(); enforceOwnerRights(snapshot, packageName, Binder.getCallingUid()); mimeTypes = CollectionUtils.emptyIfNull(mimeTypes); + for (String mimeType : mimeTypes) { + if (mimeType.length() > 255) { + throw new IllegalArgumentException("MIME type length exceeds 255 characters"); + } + } final PackageStateInternal packageState = snapshot.getPackageStateInternal(packageName); Set existingMimeTypes = packageState.getMimeGroups().get(mimeGroup); if (existingMimeTypes == null) { @@ -5811,6 +5816,10 @@ public class PackageManagerService implements PackageSender, TestUtilityService && existingMimeTypes.containsAll(mimeTypes)) { return; } + if (mimeTypes.size() > 500) { + throw new IllegalStateException("Max limit on MIME types for MIME group " + + mimeGroup + " exceeded for package " + packageName); + } ArraySet mimeTypesSet = new ArraySet<>(mimeTypes); commitPackageStateMutation(null, packageName, packageStateWrite -> { diff --git a/services/core/java/com/android/server/pm/parsing/pkg/PackageImpl.java b/services/core/java/com/android/server/pm/parsing/pkg/PackageImpl.java index 33b32f808c6bd..11fb78f39c783 100644 --- a/services/core/java/com/android/server/pm/parsing/pkg/PackageImpl.java +++ b/services/core/java/com/android/server/pm/parsing/pkg/PackageImpl.java @@ -545,6 +545,9 @@ public class PackageImpl implements ParsedPackage, AndroidPackage, for (int i = component.getIntents().size() - 1; i >= 0; i--) { IntentFilter filter = component.getIntents().get(i).getIntentFilter(); for (int groupIndex = filter.countMimeGroups() - 1; groupIndex >= 0; groupIndex--) { + if (mimeGroups != null && mimeGroups.size() > 500) { + throw new IllegalStateException("Max limit on number of MIME Groups reached"); + } mimeGroups = ArrayUtils.add(mimeGroups, filter.getMimeGroup(groupIndex)); } }