Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use IntentFilter CREATOR directly for serializing ParsedIntentInfo

Browse Source 
ParsedIntentInfo's CRFEATOR was removed because it exposes a
reparcelling vulnerability. This adjusts a system API that relied on
the implicit parcelling read to instead use IntentFilter directly,
ignoring the fields contained in the subclass.

Bug: 192050390

Test: manual, cannot repro crash after patch

Change-Id: Ib12e0a959eb5a5d73d5832ff2eee26a30eed5ded
This commit is contained in:
Winson
2021-06-25 09:59:32 -07:00
parent aa910853fb
commit f344cfad2b
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
services/core/java/com/android/server/pm/PackageManagerService.java
View File

@@ -245,7 +245,6 @@ import android.content.pm.parsing.ParsingPackageUtils;
import android.content.pm.parsing.ParsingPackageUtils.ParseFlags;
import android.content.pm.parsing.component.ParsedActivity;
import android.content.pm.parsing.component.ParsedInstrumentation;
import android.content.pm.parsing.component.ParsedIntentInfo;
import android.content.pm.parsing.component.ParsedMainComponent;
import android.content.pm.parsing.component.ParsedPermission;
import android.content.pm.parsing.component.ParsedPermissionGroup;
@@ -17102,9 +17101,15 @@ public class PackageManagerService extends IPackageManager.Stub
return new ParceledListSlice<IntentFilter>(result) {
@Override
protected void writeElement(IntentFilter parcelable, Parcel dest, int callFlags) {
// WatchedIntentFilter has final Parcelable methods, so redirect to the subclass
((ParsedIntentInfo) parcelable).writeIntentInfoToParcel(dest,
callFlags);
parcelable.writeToParcel(dest, callFlags);
}
@Override
protected void writeParcelableCreator(IntentFilter parcelable, Parcel dest) {
// All Parcel#writeParcelableCreator does is serialize the class name to
// access via reflection to grab its CREATOR. This does that manually, pointing
// to the parent IntentFilter so that all of the subclass fields are ignored.
dest.writeString(IntentFilter.class.getName());
}
};
}