Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace untyped Parcel read/write

Browse Source 
Description: Replaced `Parcel.readList()` call with empty classLoader.

Calling `Parcel.readList(,null)` could be dangerous as an attacker can
abuse the call to deserialize arbitrary parcelables. To avoid such an
attack vector, we should switch in using `Parcel.readTypedList()`
instead.

Test: atest CtsInstantAppTests
Test: atest CtsWindowManagerDeviceTestCases:MultiWindowTests
Test: atest RemoteTransitionTest
Test: Boot and observe systemUI works
Bug: 195622897
Change-Id: I7c8cb23f6f3d26b1d4d47696e70982797b5f0210
This commit is contained in:
Hao Ke
2021-09-07 17:31:26 +00:00
parent b626ccc60c
commit bc8416152b
4 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
core/java/android/content/pm/InstantAppIntentFilter.java
View File

@@ -46,7 +46,7 @@ public final class InstantAppIntentFilter implements Parcelable {
InstantAppIntentFilter(Parcel in) {
mSplitName = in.readString();
in.readList(mFilters, null /*loader*/);
in.readList(mFilters, getClass().getClassLoader());
}
public String getSplitName() {

4
core/java/android/content/pm/InstantAppResolveInfo.java
View File

@@ -143,7 +143,7 @@ public final class InstantAppResolveInfo implements Parcelable {
mDigest = in.readParcelable(null /*loader*/);
mPackageName = in.readString();
mFilters = new ArrayList<>();
in.readList(mFilters, null /*loader*/);
in.readTypedList(mFilters, InstantAppIntentFilter.CREATOR);
mVersionCode = in.readLong();
}
}
@@ -204,7 +204,7 @@ public final class InstantAppResolveInfo implements Parcelable {
}
out.writeParcelable(mDigest, flags);
out.writeString(mPackageName);
out.writeList(mFilters);
out.writeTypedList(mFilters);
out.writeLong(mVersionCode);
}

4
core/java/android/window/TransitionInfo.java
View File

@@ -140,7 +140,7 @@ public final class TransitionInfo implements Parcelable {
private TransitionInfo(Parcel in) {
mType = in.readInt();
mFlags = in.readInt();
in.readList(mChanges, null /* classLoader */);
in.readTypedList(mChanges, Change.CREATOR);
mRootLeash = new SurfaceControl();
mRootLeash.readFromParcel(in);
mRootOffset.readFromParcel(in);
@@ -152,7 +152,7 @@ public final class TransitionInfo implements Parcelable {
public void writeToParcel(@NonNull Parcel dest, int flags) {
dest.writeInt(mType);
dest.writeInt(mFlags);
dest.writeList(mChanges);
dest.writeTypedList(mChanges);
mRootLeash.writeToParcel(dest, flags);
mRootOffset.writeToParcel(dest, flags);
dest.writeTypedObject(mOptions, flags);

6
core/java/android/window/WindowContainerTransaction.java
View File

@@ -61,7 +61,7 @@ public final class WindowContainerTransaction implements Parcelable {
private WindowContainerTransaction(Parcel in) {
in.readMap(mChanges, null /* loader */);
in.readList(mHierarchyOps, null /* loader */);
in.readTypedList(mHierarchyOps, HierarchyOp.CREATOR);
mErrorCallbackToken = in.readStrongBinder();
mTaskFragmentOrganizer = ITaskFragmentOrganizer.Stub.asInterface(in.readStrongBinder());
}
@@ -643,7 +643,7 @@ public final class WindowContainerTransaction implements Parcelable {
/** @hide */
public void writeToParcel(@NonNull Parcel dest, int flags) {
dest.writeMap(mChanges);
dest.writeList(mHierarchyOps);
dest.writeTypedList(mHierarchyOps);
dest.writeStrongBinder(mErrorCallbackToken);
dest.writeStrongInterface(mTaskFragmentOrganizer);
}
@@ -916,7 +916,7 @@ public final class WindowContainerTransaction implements Parcelable {
* Changes because they must be executed in the same order that they are added.
* @hide
*/
public static class HierarchyOp implements Parcelable {
public static final class HierarchyOp implements Parcelable {
public static final int HIERARCHY_OP_TYPE_REPARENT = 0;
public static final int HIERARCHY_OP_TYPE_REORDER = 1;
public static final int HIERARCHY_OP_TYPE_CHILDREN_TASKS_REPARENT = 2;