| 修订版 | f1ca40e155b63f6259701e1fcf14b2844b42e90a (tree) |
|---|---|
| 时间 | 2018-09-12 08:08:46 |
| 作者 | Michael Wachenschwanz <mwachens@goog...> |
| Commiter | android-build-team Robot |
Verify number of Map entries written to Parcel
Make sure the number of entries written by Parcel#writeMapInternal
matches the size written. If a mismatch were allowed, an exploitable
scenario could occur where the data read from the Parcel would not
match the data written.
Fixes: 112859604
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest
Change-Id: I325d08a8b66b6e80fe76501359c41b6656848607
Merged-In: I325d08a8b66b6e80fe76501359c41b6656848607
(cherry picked from commit 057a01d1f38e9b46d3faa4059fdd7c8717681ea0)
core/java/android/os/Parcel.java (diff)| @@ -806,11 +806,19 @@ public final class Parcel { | ||
| 806 | 806 | return; |
| 807 | 807 | } |
| 808 | 808 | Set<Map.Entry<String,Object>> entries = val.entrySet(); |
| 809 | - writeInt(entries.size()); | |
| 809 | + int size = entries.size(); | |
| 810 | + writeInt(size); | |
| 811 | + | |
| 810 | 812 | for (Map.Entry<String,Object> e : entries) { |
| 811 | 813 | writeValue(e.getKey()); |
| 812 | 814 | writeValue(e.getValue()); |
| 815 | + size--; | |
| 813 | 816 | } |
| 817 | + | |
| 818 | + if (size != 0) { | |
| 819 | + throw new BadParcelableException("Map size does not match number of entries!"); | |
| 820 | + } | |
| 821 | + | |
| 814 | 822 | } |
| 815 | 823 | |
| 816 | 824 | /** |
Android-x86
Fork