From 46ee9cb29b7abecd509873a3781546b2d196916d Mon Sep 17 00:00:00 2001 From: Xiaowen Lei Date: Thu, 27 Jan 2022 19:43:00 +0000 Subject: [PATCH] Fix security vulnerability that allowed attackers to start arbitary activities. Bug: 189574230 Test: flash device and check dream picker. Test: installed POC and confirmed that "Customize" no longer shows. Change-Id: Ia8ac9b2fe6da4396922ed9e43d6eb16b0f7f9f66 --- .../com/android/settingslib/dream/DreamBackend.java | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java b/packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java index 46e31ceb74857..c127f0474ae21 100644 --- a/packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java +++ b/packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java @@ -489,7 +489,18 @@ public class DreamBackend { if (flattenedString.indexOf('/') < 0) { flattenedString = serviceInfo.packageName + "/" + flattenedString; } - return ComponentName.unflattenFromString(flattenedString); + + ComponentName cn = ComponentName.unflattenFromString(flattenedString); + + if (cn == null) return null; + if (!cn.getPackageName().equals(serviceInfo.packageName)) { + Log.w(TAG, + "Inconsistent package name in component: " + cn.getPackageName() + + ", should be: " + serviceInfo.packageName); + return null; + } + + return cn; } private static DreamMetadata getDreamMetadata(PackageManager pm, ResolveInfo resolveInfo) {