frameworks/base
Revision | f1ca40e155b63f6259701e1fcf14b2844b42e90a (tree) |
---|---|
Zeit | 2018-09-12 08:08:46 |
Autor | Michael Wachenschwanz <mwachens@goog...> |
Commiter | android-build-team Robot |
Verify number of Map entries written to Parcel
Make sure the number of entries written by Parcel#writeMapInternal
matches the size written. If a mismatch were allowed, an exploitable
scenario could occur where the data read from the Parcel would not
match the data written.
Fixes: 112859604
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest
Change-Id: I325d08a8b66b6e80fe76501359c41b6656848607
Merged-In: I325d08a8b66b6e80fe76501359c41b6656848607
(cherry picked from commit 057a01d1f38e9b46d3faa4059fdd7c8717681ea0)
@@ -806,11 +806,19 @@ public final class Parcel { | ||
806 | 806 | return; |
807 | 807 | } |
808 | 808 | Set<Map.Entry<String,Object>> entries = val.entrySet(); |
809 | - writeInt(entries.size()); | |
809 | + int size = entries.size(); | |
810 | + writeInt(size); | |
811 | + | |
810 | 812 | for (Map.Entry<String,Object> e : entries) { |
811 | 813 | writeValue(e.getKey()); |
812 | 814 | writeValue(e.getValue()); |
815 | + size--; | |
813 | 816 | } |
817 | + | |
818 | + if (size != 0) { | |
819 | + throw new BadParcelableException("Map size does not match number of entries!"); | |
820 | + } | |
821 | + | |
814 | 822 | } |
815 | 823 | |
816 | 824 | /** |