From 561e2861dff5d61b69855cc56072db99624148d8 Mon Sep 17 00:00:00 2001
From: Victor Hsieh <victorhsieh@google.com>
Date: Thu, 10 Oct 2019 16:09:21 -0700
Subject: [PATCH] Fix JNI misuse during fs-verity setup

jByteArray can't be used directly.

Test: atest com.android.apkverity.ApkVerityTest
Bug: 142504243
Change-Id: I65f45e72412c62330d573c4245cff7ad78c96c20
---
 .../core/jni/com_android_server_security_VerityUtils.cpp | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/services/core/jni/com_android_server_security_VerityUtils.cpp b/services/core/jni/com_android_server_security_VerityUtils.cpp
index 9ceb7706628ae..3f165af007bac 100644
--- a/services/core/jni/com_android_server_security_VerityUtils.cpp
+++ b/services/core/jni/com_android_server_security_VerityUtils.cpp
@@ -17,6 +17,7 @@
 #define LOG_TAG "VerityUtils"
 
 #include <nativehelper/JNIHelp.h>
+#include <nativehelper/ScopedPrimitiveArray.h>
 #include "jni.h"
 #include <utils/Log.h>
 
@@ -78,6 +79,10 @@ int enableFsverity(JNIEnv* env, jobject /* clazz */, jstring filePath, jbyteArra
     if (rfd.get() < 0) {
       return errno;
     }
+    ScopedByteArrayRO signature_bytes(env, signature);
+    if (signature_bytes.get() == nullptr) {
+        return EINVAL;
+    }
 
     fsverity_enable_arg arg = {};
     arg.version = 1;
@@ -85,8 +90,8 @@ int enableFsverity(JNIEnv* env, jobject /* clazz */, jstring filePath, jbyteArra
     arg.block_size = 4096;
     arg.salt_size = 0;
     arg.salt_ptr = reinterpret_cast<uintptr_t>(nullptr);
-    arg.sig_size = env->GetArrayLength(signature);
-    arg.sig_ptr = reinterpret_cast<uintptr_t>(signature);
+    arg.sig_size = signature_bytes.size();
+    arg.sig_ptr = reinterpret_cast<uintptr_t>(signature_bytes.get());
 
     if (ioctl(rfd.get(), FS_IOC_ENABLE_VERITY, &arg) < 0) {
       return errno;