Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

am 42a23783: Merge "Add more checks for bad values to protect from corrupt files." into gingerbread

Browse Source 
* commit '42a23783aaabdb4e6f37ccd822d8c85f31ba8519':
  Add more checks for bad values to protect from corrupt files.
This commit is contained in:
Dianne Hackborn
2010-12-07 22:07:40 -08:00
committed by Android Git Automerger
parent 4e345ab7df 42a23783aa
commit c4b7088f19
1 changed files with 22 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
core/java/com/android/internal/os/BatteryStatsImpl.java
View File

@@ -3079,13 +3079,18 @@ public final class BatteryStatsImpl extends BatteryStats {
}
}
void readExcessivePowerFromParcelLocked(Parcel in) {
boolean readExcessivePowerFromParcelLocked(Parcel in) {
final int N = in.readInt();
if (N == 0) {
mExcessivePower = null;
return;
return true;
}
if (N > 10000) {
Slog.w(TAG, "File corrupt: too many excessive power entries " + N);
return false;
}
mExcessivePower = new ArrayList<ExcessivePower>();
for (int i=0; i<N; i++) {
ExcessivePower ew = new ExcessivePower();
@@ -3094,6 +3099,7 @@ public final class BatteryStatsImpl extends BatteryStats {
ew.usedTime = in.readLong();
mExcessivePower.add(ew);
}
return true;
}
void writeToParcelLocked(Parcel out) {
@@ -4689,7 +4695,7 @@ public final class BatteryStatsImpl extends BatteryStats {
}
int NW = in.readInt();
if (NW > 10000) {
if (NW > 100) {
Slog.w(TAG, "File corrupt: too many wake locks " + NW);
return;
}
@@ -4707,7 +4713,7 @@ public final class BatteryStatsImpl extends BatteryStats {
}
int NP = in.readInt();
if (NP > 10000) {
if (NP > 1000) {
Slog.w(TAG, "File corrupt: too many sensors " + NP);
return;
}
@@ -4720,7 +4726,7 @@ public final class BatteryStatsImpl extends BatteryStats {
}
NP = in.readInt();
if (NP > 10000) {
if (NP > 1000) {
Slog.w(TAG, "File corrupt: too many processes " + NP);
return;
}
@@ -4731,6 +4737,10 @@ public final class BatteryStatsImpl extends BatteryStats {
p.mSystemTime = p.mLoadedSystemTime = in.readLong();
p.mStarts = p.mLoadedStarts = in.readInt();
int NSB = in.readInt();
if (NSB > 100) {
Slog.w(TAG, "File corrupt: too many speed bins " + NSB);
return;
}
p.mSpeedBins = new SamplingCounter[NSB];
for (int i=0; i<NSB; i++) {
if (in.readInt() != 0) {
@@ -4738,7 +4748,9 @@ public final class BatteryStatsImpl extends BatteryStats {
p.mSpeedBins[i].readSummaryFromParcelLocked(in);
}
}
p.readExcessivePowerFromParcelLocked(in);
if (!p.readExcessivePowerFromParcelLocked(in)) {
return;
}
}
NP = in.readInt();
@@ -4751,6 +4763,10 @@ public final class BatteryStatsImpl extends BatteryStats {
Uid.Pkg p = u.getPackageStatsLocked(pkgName);
p.mWakeups = p.mLoadedWakeups = in.readInt();
final int NS = in.readInt();
if (NS > 1000) {
Slog.w(TAG, "File corrupt: too many services " + NS);
return;
}
for (int is = 0; is < NS; is++) {
String servName = in.readString();
Uid.Pkg.Serv s = u.getServiceStatsLocked(pkgName, servName);