Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use IntentFilter CREATOR directly for serializing ParsedIntentInfo

Browse Source 
ParsedIntentInfo's CRFEATOR was removed because it exposes a
reparcelling vulnerability. This adjusts a system API that relied on
the implicit parcelling read to instead use IntentFilter directly,
ignoring the fields contained in the subclass.

Bug: 192050390

Test: manual, cannot repro crash after patch

Change-Id: Ib12e0a959eb5a5d73d5832ff2eee26a30eed5ded
This commit is contained in:
Winson
2021-06-25 09:59:32 -07:00
parent aa910853fb
commit f344cfad2b
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -245,7 +245,6 @@ import android.content.pm.parsing.ParsingPackageUtils;
import android.content.pm.parsing.ParsingPackageUtils.ParseFlags; import android.content.pm.parsing.ParsingPackageUtils.ParseFlags;
import android.content.pm.parsing.component.ParsedActivity; import android.content.pm.parsing.component.ParsedActivity;
import android.content.pm.parsing.component.ParsedInstrumentation; import android.content.pm.parsing.component.ParsedInstrumentation;
import android.content.pm.parsing.component.ParsedIntentInfo;
import android.content.pm.parsing.component.ParsedMainComponent; import android.content.pm.parsing.component.ParsedMainComponent;
import android.content.pm.parsing.component.ParsedPermission; import android.content.pm.parsing.component.ParsedPermission;
import android.content.pm.parsing.component.ParsedPermissionGroup; import android.content.pm.parsing.component.ParsedPermissionGroup;
@@ -17102,9 +17101,15 @@ public class PackageManagerService extends IPackageManager.Stub
return new ParceledListSlice<IntentFilter>(result) { return new ParceledListSlice<IntentFilter>(result) {
@Override @Override
protected void writeElement(IntentFilter parcelable, Parcel dest, int callFlags) { protected void writeElement(IntentFilter parcelable, Parcel dest, int callFlags) {
// WatchedIntentFilter has final Parcelable methods, so redirect to the subclass parcelable.writeToParcel(dest, callFlags);
((ParsedIntentInfo) parcelable).writeIntentInfoToParcel(dest, }
callFlags);
@Override
protected void writeParcelableCreator(IntentFilter parcelable, Parcel dest) {
// All Parcel#writeParcelableCreator does is serialize the class name to
// access via reflection to grab its CREATOR. This does that manually, pointing
// to the parent IntentFilter so that all of the subclass fields are ignored.
dest.writeString(IntentFilter.class.getName());
} }
}; };
} }