From b7d62363d2bd1e2f25a07e72753da0189985ba67 Mon Sep 17 00:00:00 2001 From: Jackal Guo Date: Tue, 10 Jan 2023 16:18:02 +0800 Subject: [PATCH] Limit length of the name in To mitigate a boot loop with a huge name string, this CL restricts the max length of the name in attr. Bug: 259942609 Test: manually using the PoC in the buganizer to ensure the symptom no longer exists. Change-Id: I35dde9d6bea9eb7c1b81e8cbadeeb908b3fb713f --- .../server/pm/pkg/parsing/ParsingPackageUtils.java | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/services/core/java/com/android/server/pm/pkg/parsing/ParsingPackageUtils.java b/services/core/java/com/android/server/pm/pkg/parsing/ParsingPackageUtils.java index 995b9e58b3e30..4102981e1597f 100644 --- a/services/core/java/com/android/server/pm/pkg/parsing/ParsingPackageUtils.java +++ b/services/core/java/com/android/server/pm/pkg/parsing/ParsingPackageUtils.java @@ -247,6 +247,9 @@ public class ParsingPackageUtils { private static final String MAX_NUM_COMPONENTS_ERR_MSG = "Total number of components has exceeded the maximum number: " + MAX_NUM_COMPONENTS; + /** The maximum permission name length. */ + private static final int MAX_PERMISSION_NAME_LENGTH = 512; + @IntDef(flag = true, prefix = { "PARSE_" }, value = { PARSE_CHATTY, PARSE_COLLECT_CERTIFICATES, @@ -1260,6 +1263,11 @@ public class ParsingPackageUtils { // that may change. String name = sa.getNonResourceString( R.styleable.AndroidManifestUsesPermission_name); + if (TextUtils.length(name) > MAX_PERMISSION_NAME_LENGTH) { + return input.error(INSTALL_PARSE_FAILED_MANIFEST_MALFORMED, + "The name in the is greater than " + + MAX_PERMISSION_NAME_LENGTH); + } int minSdkVersion = parseMinOrMaxSdkVersion(sa, R.styleable.AndroidManifestUsesPermission_minSdkVersion,