From f344cfad2bd03da73ce7cfe0b0b19b3a37b45344 Mon Sep 17 00:00:00 2001 From: Winson Date: Fri, 25 Jun 2021 09:59:32 -0700 Subject: [PATCH] Use IntentFilter CREATOR directly for serializing ParsedIntentInfo ParsedIntentInfo's CRFEATOR was removed because it exposes a reparcelling vulnerability. This adjusts a system API that relied on the implicit parcelling read to instead use IntentFilter directly, ignoring the fields contained in the subclass. Bug: 192050390 Test: manual, cannot repro crash after patch Change-Id: Ib12e0a959eb5a5d73d5832ff2eee26a30eed5ded --- .../android/server/pm/PackageManagerService.java | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/services/core/java/com/android/server/pm/PackageManagerService.java b/services/core/java/com/android/server/pm/PackageManagerService.java index 2419873cdc416..f44241ddc3fec 100644 --- a/services/core/java/com/android/server/pm/PackageManagerService.java +++ b/services/core/java/com/android/server/pm/PackageManagerService.java @@ -245,7 +245,6 @@ import android.content.pm.parsing.ParsingPackageUtils; import android.content.pm.parsing.ParsingPackageUtils.ParseFlags; import android.content.pm.parsing.component.ParsedActivity; import android.content.pm.parsing.component.ParsedInstrumentation; -import android.content.pm.parsing.component.ParsedIntentInfo; import android.content.pm.parsing.component.ParsedMainComponent; import android.content.pm.parsing.component.ParsedPermission; import android.content.pm.parsing.component.ParsedPermissionGroup; @@ -17102,9 +17101,15 @@ public class PackageManagerService extends IPackageManager.Stub return new ParceledListSlice(result) { @Override protected void writeElement(IntentFilter parcelable, Parcel dest, int callFlags) { - // WatchedIntentFilter has final Parcelable methods, so redirect to the subclass - ((ParsedIntentInfo) parcelable).writeIntentInfoToParcel(dest, - callFlags); + parcelable.writeToParcel(dest, callFlags); + } + + @Override + protected void writeParcelableCreator(IntentFilter parcelable, Parcel dest) { + // All Parcel#writeParcelableCreator does is serialize the class name to + // access via reflection to grab its CREATOR. This does that manually, pointing + // to the parent IntentFilter so that all of the subclass fields are ignored. + dest.writeString(IntentFilter.class.getName()); } }; }