diff options
| author | 2022-03-15 17:24:14 +0000 | |
|---|---|---|
| committer | 2022-03-15 17:24:14 +0000 | |
| commit | ef3ff1fb7c70a65fb119509a6a7e6daa1a726ce2 (patch) | |
| tree | fc32941a1293ba1eec9d52768d393228f1fdde8a | |
| parent | 1fa80dfaa537daf21cfe4b07d81bfa24a0b9fb9d (diff) | |
| parent | 2d2be5a206b385b9cee44c6bbc3565c74d4dcf0e (diff) | |
Merge "libbinder*: ParcelableHolder assert stability read" am: 2d2be5a206
Original change: https://android-review.googlesource.com/c/platform/frameworks/native/+/2020840
Change-Id: Ia2f738c9eed0955cb0525aaf2205bbfce12bb52b
| -rw-r--r-- | libs/binder/ParcelableHolder.cpp | 5 | ||||
| -rw-r--r-- | libs/binder/ndk/include_cpp/android/binder_parcelable_utils.h | 7 | ||||
| -rw-r--r-- | libs/binder/rust/src/parcel/parcelable_holder.rs | 4 |
3 files changed, 13 insertions, 3 deletions
diff --git a/libs/binder/ParcelableHolder.cpp b/libs/binder/ParcelableHolder.cpp index 2e86b7415a..3cf94e3047 100644 --- a/libs/binder/ParcelableHolder.cpp +++ b/libs/binder/ParcelableHolder.cpp @@ -52,7 +52,10 @@ status_t ParcelableHolder::writeToParcel(Parcel* p) const { } status_t ParcelableHolder::readFromParcel(const Parcel* p) { - this->mStability = static_cast<Stability>(p->readInt32()); + int32_t wireStability; + if (status_t status = p->readInt32(&wireStability); status != OK) return status; + if (static_cast<int32_t>(this->mStability) != wireStability) return BAD_VALUE; + this->mParcelable = nullptr; this->mParcelableName = std::nullopt; int32_t rawDataSize; diff --git a/libs/binder/ndk/include_cpp/android/binder_parcelable_utils.h b/libs/binder/ndk/include_cpp/android/binder_parcelable_utils.h index 28819bb42a..f45aa7631b 100644 --- a/libs/binder/ndk/include_cpp/android/binder_parcelable_utils.h +++ b/libs/binder/ndk/include_cpp/android/binder_parcelable_utils.h @@ -101,7 +101,12 @@ class AParcelableHolder { return STATUS_INVALID_OPERATION; } - RETURN_ON_FAILURE(AParcel_readInt32(parcel, &this->mStability)); + parcelable_stability_t wireStability; + RETURN_ON_FAILURE(AParcel_readInt32(parcel, &wireStability)); + if (this->mStability != wireStability) { + return STATUS_BAD_VALUE; + } + int32_t dataSize; binder_status_t status = AParcel_readInt32(parcel, &dataSize); diff --git a/libs/binder/rust/src/parcel/parcelable_holder.rs b/libs/binder/rust/src/parcel/parcelable_holder.rs index d58e839ad4..432da5dfd7 100644 --- a/libs/binder/rust/src/parcel/parcelable_holder.rs +++ b/libs/binder/rust/src/parcel/parcelable_holder.rs @@ -233,7 +233,9 @@ impl Parcelable for ParcelableHolder { } fn read_from_parcel(&mut self, parcel: &BorrowedParcel<'_>) -> Result<(), StatusCode> { - self.stability = parcel.read()?; + if self.stability != parcel.read()? { + return Err(StatusCode::BAD_VALUE); + } let data_size: i32 = parcel.read()?; if data_size < 0 { |