Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[RESTRICT AUTOMERGE] Limit length of the name in <uses-permission>

Browse Source 
To mitigate a boot loop with a huge name string, this CL restricts
the max length of the name in <users-permission> attr.

Bug: 259942609
Test: manually using the PoC in the buganizer to ensure the symptom
      no longer exists.
Change-Id: I35dde9d6bea9eb7c1b81e8cbadeeb908b3fb713f
This commit is contained in:
Jackal Guo
2023-01-11 14:36:32 +08:00
parent 8167356f3d
commit de8ef32d02
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
services/core/java/com/android/server/pm/pkg/parsing/ParsingPackageUtils.java
View File

@@ -245,6 +245,9 @@ public class ParsingPackageUtils {
private static final String MAX_NUM_COMPONENTS_ERR_MSG = private static final String MAX_NUM_COMPONENTS_ERR_MSG =
"Total number of components has exceeded the maximum number: " + MAX_NUM_COMPONENTS; "Total number of components has exceeded the maximum number: " + MAX_NUM_COMPONENTS;
/** The maximum permission name length. */
private static final int MAX_PERMISSION_NAME_LENGTH = 512;
@IntDef(flag = true, prefix = { "PARSE_" }, value = { @IntDef(flag = true, prefix = { "PARSE_" }, value = {
PARSE_CHATTY, PARSE_CHATTY,
PARSE_COLLECT_CERTIFICATES, PARSE_COLLECT_CERTIFICATES,
@@ -1271,6 +1274,11 @@ public class ParsingPackageUtils {
// that may change. // that may change.
String name = sa.getNonResourceString( String name = sa.getNonResourceString(
R.styleable.AndroidManifestUsesPermission_name); R.styleable.AndroidManifestUsesPermission_name);
if (TextUtils.length(name) > MAX_PERMISSION_NAME_LENGTH) {
return input.error(INSTALL_PARSE_FAILED_MANIFEST_MALFORMED,
"The name in the <uses-permission> is greater than "
+ MAX_PERMISSION_NAME_LENGTH);
}
int maxSdkVersion = 0; int maxSdkVersion = 0;
TypedValue val = sa.peekValue( TypedValue val = sa.peekValue(