diff options
| author | 2025-01-23 11:18:35 -0800 | |
|---|---|---|
| committer | 2025-02-04 10:46:13 -0800 | |
| commit | 17b134890250e2909240a5a1ca4093ecba424943 (patch) | |
| tree | a0beeb308d5daadb656ef9773afbb2cb51833e6a /libs/androidfw/Util.cpp | |
| parent | bf6d25ffa000e441635f70c5d9feb4dbd54f0f55 (diff) | |
Impose a threshold on the number of attributed op entries returned in a binder call
In the binder call IAppOpsService#getPackagesForOpsForDevice, we return
attributed op entries encapsulated in PackageOps. When there are too
many attribution tags used for a lot of ops, the size of PackageOps can
be bloated and exceeds the binder transaction limit. However, this is
usually caused by DoS attack from malicious apps. A normal app wouldn't
run into this problem.
This CL adds a threshold on the number of attributed op entries that can
be returned in a binder call. The threshold is calculated assuming each
attribution tag is 50 bytes long.
Bug: 372678095
Test: manual. Using provided POC app from the reporter.
Verified the exception is gone after the fix.
Flag: EXEMPT bugfix
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:eec34e2716bfa613be30b0a0b9a173e2005a6c00)
Merged-In: I43cd4b9774dbe554edcec296c4b8a3d7fc60c85c
Change-Id: I43cd4b9774dbe554edcec296c4b8a3d7fc60c85c
Diffstat (limited to 'libs/androidfw/Util.cpp')
0 files changed, 0 insertions, 0 deletions