From eb695e1fe9baba71d1b460e1a8249190f3ade4f7 Mon Sep 17 00:00:00 2001 From: Pawan Wagh Date: Tue, 13 Jun 2023 17:37:26 +0000 Subject: Use readUniqueFileDescriptor in incidentd service readFileDescriptor doesn't provide ownership of the fds. fdopen needs ownership of the fds. Fds read from parcel should be duped in this scenario and readUniqueFileDescriptor dups fds internally. Test: m incidentd_service_fuzzer && adb sync data && adb shell /data/fuzz/x86_64/incidentd_service_fuzzer/incidentd_service_fuzzer Test: atest incidentd_test Bug: 286931110 Bug: 283699145 Merged-In: Ibe03a17dee91ac5bf25d123d4fd9c0bdd3c7d80e Change-Id: Ibe03a17dee91ac5bf25d123d4fd9c0bdd3c7d80e (cherry picked from commit ba78ef276951269f7b024baebdf1b8fa40bedb23) --- cmds/incidentd/src/IncidentService.cpp | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/cmds/incidentd/src/IncidentService.cpp b/cmds/incidentd/src/IncidentService.cpp index 5af02f405ed9..0d3ae9b22476 100644 --- a/cmds/incidentd/src/IncidentService.cpp +++ b/cmds/incidentd/src/IncidentService.cpp @@ -502,9 +502,13 @@ status_t IncidentService::onTransact(uint32_t code, const Parcel& data, Parcel* switch (code) { case SHELL_COMMAND_TRANSACTION: { - int in = data.readFileDescriptor(); - int out = data.readFileDescriptor(); - int err = data.readFileDescriptor(); + unique_fd in, out, err; + if (status_t status = data.readUniqueFileDescriptor(&in); status != OK) return status; + + if (status_t status = data.readUniqueFileDescriptor(&out); status != OK) return status; + + if (status_t status = data.readUniqueFileDescriptor(&err); status != OK) return status; + int argc = data.readInt32(); Vector args; for (int i = 0; i < argc && data.dataAvail() > 0; i++) { @@ -514,15 +518,15 @@ status_t IncidentService::onTransact(uint32_t code, const Parcel& data, Parcel* sp resultReceiver = IResultReceiver::asInterface(data.readStrongBinder()); - FILE* fin = fdopen(in, "r"); - FILE* fout = fdopen(out, "w"); - FILE* ferr = fdopen(err, "w"); + FILE* fin = fdopen(in.release(), "r"); + FILE* fout = fdopen(out.release(), "w"); + FILE* ferr = fdopen(err.release(), "w"); if (fin == NULL || fout == NULL || ferr == NULL) { resultReceiver->send(NO_MEMORY); } else { - err = command(fin, fout, ferr, args); - resultReceiver->send(err); + status_t result = command(fin, fout, ferr, args); + resultReceiver->send(result); } if (fin != NULL) { -- cgit v1.2.3-59-g8ed1b