diff options
| author | 2025-01-23 11:18:35 -0800 | |
|---|---|---|
| committer | 2025-02-04 11:45:33 -0800 | |
| commit | 8e7990cecce808d9dd9465bb8526211b0086e881 (patch) | |
| tree | 3fd2cd783abf7296cce200764c33924e87757647 /libs/androidfw/AssetManager.cpp | |
| parent | 99619bea4e60bf391b8dec32366ca030f4a44b82 (diff) | |
[DO NOT MERGE] Impose a threshold on the number of attributed op entries returned in a binder call
In the binder call IAppOpsService#getPackagesForOpsForDevice, we return
attributed op entries encapsulated in PackageOps. When there are too
many attribution tags used for a lot of ops, the size of PackageOps can
be bloated and exceeds the binder transaction limit. However, this is
usually caused by DoS attack from malicious apps. A normal app wouldn't
run into this problem.
This CL adds a threshold on the number of attributed op entries that can
be returned in a binder call. The threshold is calculated assuming each
attribution tag is 50 bytes long.
Bug: 372678095
Test: manual. Using provided POC app from the reporter.
Verified the exception is gone after the fix.
Flag: EXEMPT bugfix
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:eec34e2716bfa613be30b0a0b9a173e2005a6c00)
Merged-In: I43cd4b9774dbe554edcec296c4b8a3d7fc60c85c
Change-Id: I43cd4b9774dbe554edcec296c4b8a3d7fc60c85c
Diffstat (limited to 'libs/androidfw/AssetManager.cpp')
0 files changed, 0 insertions, 0 deletions