From 63be7a732e16dda1bfd93c449accf5ff20d8e145 Mon Sep 17 00:00:00 2001
From: Kenny Root <kroot@google.com>
Date: Wed, 1 Dec 2010 11:37:36 -0800
Subject: Grant ACCESS_ALL_DOWNLOADS to DefaultContainerService

Be compatible with the old DownloadProvider behavior of being able to
operate on content URIs returned from .insert()

Bug: 3242328
Change-Id: Ibd2ed553c87ea694d4b09a8265c7131fae588719
---
 core/java/android/provider/Downloads.java            | 9 ++++++++-
 packages/DefaultContainerService/AndroidManifest.xml | 1 +
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/core/java/android/provider/Downloads.java b/core/java/android/provider/Downloads.java
index 72bf6b08d684..1ca6d3a8c06b 100644
--- a/core/java/android/provider/Downloads.java
+++ b/core/java/android/provider/Downloads.java
@@ -600,7 +600,14 @@ public final class Downloads {
                 "android.permission.ACCESS_DOWNLOAD_MANAGER_ADVANCED";
 
         /**
-         * The permission to directly access the download manager's cache directory
+         * The permission to access the all the downloads in the manager.
+         */
+        public static final String PERMISSION_ACCESS_ALL =
+                "android.permission.ACCESS_ALL_DOWNLOADS";
+
+        /**
+         * The permission to directly access the download manager's cache
+         * directory
          */
         public static final String PERMISSION_CACHE = "android.permission.ACCESS_CACHE_FILESYSTEM";
 
diff --git a/packages/DefaultContainerService/AndroidManifest.xml b/packages/DefaultContainerService/AndroidManifest.xml
index 078daa76d501..b0597c4e6ee4 100755
--- a/packages/DefaultContainerService/AndroidManifest.xml
+++ b/packages/DefaultContainerService/AndroidManifest.xml
@@ -1,6 +1,7 @@
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
         package="com.android.defcontainer">
     <uses-permission android:name="android.permission.ACCESS_DOWNLOAD_MANAGER"/>
+    <uses-permission android:name="android.permission.ACCESS_ALL_DOWNLOADS"/>
     <uses-permission android:name="android.permission.ASEC_ACCESS"/>
     <uses-permission android:name="android.permission.ASEC_CREATE"/>
     <uses-permission android:name="android.permission.ASEC_DESTROY"/>
-- 
cgit v1.2.3-59-g8ed1b


From e59e0309a1301908eae0075db02413fda90848d5 Mon Sep 17 00:00:00 2001
From: Dianne Hackborn <hackbod@google.com>
Date: Tue, 7 Dec 2010 11:14:53 -0800
Subject: Add more checks for bad values to protect from corrupt files.

Change-Id: I5e282099e7c6fcc8756146fc7282eec31937af1f
---
 .../com/android/internal/os/BatteryStatsImpl.java  | 28 +++++++++++++++++-----
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/core/java/com/android/internal/os/BatteryStatsImpl.java b/core/java/com/android/internal/os/BatteryStatsImpl.java
index bc6d6d26e473..abc88e87803e 100644
--- a/core/java/com/android/internal/os/BatteryStatsImpl.java
+++ b/core/java/com/android/internal/os/BatteryStatsImpl.java
@@ -3077,13 +3077,18 @@ public final class BatteryStatsImpl extends BatteryStats {
                 }
             }
 
-            void readExcessivePowerFromParcelLocked(Parcel in) {
+            boolean readExcessivePowerFromParcelLocked(Parcel in) {
                 final int N = in.readInt();
                 if (N == 0) {
                     mExcessivePower = null;
-                    return;
+                    return true;
                 }
 
+                if (N > 10000) {
+                    Slog.w(TAG, "File corrupt: too many excessive power entries " + N);
+                    return false;
+                }
+                
                 mExcessivePower = new ArrayList<ExcessivePower>();
                 for (int i=0; i<N; i++) {
                     ExcessivePower ew = new ExcessivePower();
@@ -3092,6 +3097,7 @@ public final class BatteryStatsImpl extends BatteryStats {
                     ew.usedTime = in.readLong();
                     mExcessivePower.add(ew);
                 }
+                return true;
             }
 
             void writeToParcelLocked(Parcel out) {
@@ -4687,7 +4693,7 @@ public final class BatteryStatsImpl extends BatteryStats {
             }
             
             int NW = in.readInt();
-            if (NW > 10000) {
+            if (NW > 100) {
                 Slog.w(TAG, "File corrupt: too many wake locks " + NW);
                 return;
             }
@@ -4705,7 +4711,7 @@ public final class BatteryStatsImpl extends BatteryStats {
             }
 
             int NP = in.readInt();
-            if (NP > 10000) {
+            if (NP > 1000) {
                 Slog.w(TAG, "File corrupt: too many sensors " + NP);
                 return;
             }
@@ -4718,7 +4724,7 @@ public final class BatteryStatsImpl extends BatteryStats {
             }
 
             NP = in.readInt();
-            if (NP > 10000) {
+            if (NP > 1000) {
                 Slog.w(TAG, "File corrupt: too many processes " + NP);
                 return;
             }
@@ -4729,6 +4735,10 @@ public final class BatteryStatsImpl extends BatteryStats {
                 p.mSystemTime = p.mLoadedSystemTime = in.readLong();
                 p.mStarts = p.mLoadedStarts = in.readInt();
                 int NSB = in.readInt();
+                if (NSB > 100) {
+                    Slog.w(TAG, "File corrupt: too many speed bins " + NSB);
+                    return;
+                }
                 p.mSpeedBins = new SamplingCounter[NSB];
                 for (int i=0; i<NSB; i++) {
                     if (in.readInt() != 0) {
@@ -4736,7 +4746,9 @@ public final class BatteryStatsImpl extends BatteryStats {
                         p.mSpeedBins[i].readSummaryFromParcelLocked(in);
                     }
                 }
-                p.readExcessivePowerFromParcelLocked(in);
+                if (!p.readExcessivePowerFromParcelLocked(in)) {
+                    return;
+                }
             }
 
             NP = in.readInt();
@@ -4749,6 +4761,10 @@ public final class BatteryStatsImpl extends BatteryStats {
                 Uid.Pkg p = u.getPackageStatsLocked(pkgName);
                 p.mWakeups = p.mLoadedWakeups = in.readInt();
                 final int NS = in.readInt();
+                if (NS > 1000) {
+                    Slog.w(TAG, "File corrupt: too many services " + NS);
+                    return;
+                }
                 for (int is = 0; is < NS; is++) {
                     String servName = in.readString();
                     Uid.Pkg.Serv s = u.getServiceStatsLocked(pkgName, servName);
-- 
cgit v1.2.3-59-g8ed1b