ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix vold vulnerability in FrameworkListener am: 470484d2a2 am: e9e046df6c am: 109024f74a am: b906ad88b9 am: 2fadbb93a4 am: e04054d9bb am: 9745b11db1 am: 2f78b2c3d6 am: 2b5e6d8ffc am: 2427a462c0

Browse source 
am: 6b155c1cc4

Change-Id: Ie6c2bcee1deacb94259a6153097757674fa19251
This commit is contained in:
Connor O'Brien 2016-08-19 22:50:00 +00:00 • committed by android-build-merger
commit 2f16eeede6
2 changed files with 15 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
include/sysutils/FrameworkListener.h
View file

@ -32,6 +32,7 @@ private:
int mCommandCount; int mCommandCount;
bool mWithSeq; bool mWithSeq;
FrameworkCommandCollection *mCommands; FrameworkCommandCollection *mCommands;
bool mSkipToNextNullByte;
public: public:
FrameworkListener(const char *socketName); FrameworkListener(const char *socketName);

17
libsysutils/src/FrameworkListener.cpp
View file

@ -49,6 +49,7 @@ void FrameworkListener::init(const char *socketName UNUSED, bool withSeq) {
errorRate = 0; errorRate = 0;
mCommandCount = 0; mCommandCount = 0;
mWithSeq = withSeq; mWithSeq = withSeq;
mSkipToNextNullByte = false;
} }
bool FrameworkListener::onDataAvailable(SocketClient *c) { bool FrameworkListener::onDataAvailable(SocketClient *c) {
@ -59,10 +60,15 @@ bool FrameworkListener::onDataAvailable(SocketClient *c) {
if (len < 0) { if (len < 0) {
SLOGE("read() failed (%s)", strerror(errno)); SLOGE("read() failed (%s)", strerror(errno));
return false; return false;
} else if (!len) } else if (!len) {
return false; return false;
if(buffer[len-1] != '\0') } else if (buffer[len-1] != '\0') {
SLOGW("String is not zero-terminated"); SLOGW("String is not zero-terminated");
android_errorWriteLog(0x534e4554, "29831647");
c->sendMsg(500, "Command too large for buffer", false);
mSkipToNextNullByte = true;
return false;
}
int offset = 0; int offset = 0;
int i; int i;
@ -70,11 +76,16 @@ bool FrameworkListener::onDataAvailable(SocketClient *c) {
for (i = 0; i < len; i++) { for (i = 0; i < len; i++) {
if (buffer[i] == '\0') { if (buffer[i] == '\0') {
/* IMPORTANT: dispatchCommand() expects a zero-terminated string */ /* IMPORTANT: dispatchCommand() expects a zero-terminated string */
dispatchCommand(c, buffer + offset); if (mSkipToNextNullByte) {
mSkipToNextNullByte = false;
} else {
dispatchCommand(c, buffer + offset);
}
offset = i + 1; offset = i + 1;
} }
} }
mSkipToNextNullByte = false;
return true; return true;
} }