diff options
| author | 2025-01-23 11:18:35 -0800 | |
|---|---|---|
| committer | 2025-02-04 10:39:46 -0800 | |
| commit | b0fb67bb0c3523fd0c59b76e83e356ea244c276b (patch) | |
| tree | c3bdf873f9991f637290b30a9b88ee04061793c7 /libs/androidfw/Util.cpp | |
| parent | b6657d121b8280ff853c8eee19ad72d2e8022421 (diff) | |
Impose a threshold on the number of attributed op entries returned in a binder call
In the binder call IAppOpsService#getPackagesForOpsForDevice, we return
attributed op entries encapsulated in PackageOps. When there are too
many attribution tags used for a lot of ops, the size of PackageOps can
be bloated and exceeds the binder transaction limit. However, this is
usually caused by DoS attack from malicious apps. A normal app wouldn't
run into this problem.
This CL adds a threshold on the number of attributed op entries that can
be returned in a binder call. The threshold is calculated assuming each
attribution tag is 50 bytes long.
Bug: 372678095
Test: manual. Using provided POC app from the reporter.
Verified the exception is gone after the fix.
Flag: EXEMPT bugfix
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:eec34e2716bfa613be30b0a0b9a173e2005a6c00)
Merged-In: I43cd4b9774dbe554edcec296c4b8a3d7fc60c85c
Change-Id: I43cd4b9774dbe554edcec296c4b8a3d7fc60c85c
Diffstat (limited to 'libs/androidfw/Util.cpp')
0 files changed, 0 insertions, 0 deletions