diff options
| author | William Leshner <wleshner@google.com> | 2023-11-01 18:03:35 +0000 |
|---|---|---|
| committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2023-11-10 18:30:27 +0000 |
| commit | 1175720b7c8d0ebc20ac96635578018b2b626292 (patch) | |
| tree | 3e8c46c4e30d95db26d4024b727316ec4ab1f8d0 | |
| parent | 3fdf954905afc5b8414af22b112861b10ef26d53 (diff) | |
| download | base-1175720b7c8d0ebc20ac96635578018b2b626292.tar.gz | |
Fix vulnerability that allowed attackers to start arbitary activities
Test: Flashed device and verified dream settings works as expected
Test: Installed APK from bug and verified the dream didn't allow
launching the inappropriate settings activity.
Fixes: 300090204
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:bf8ff047eb25960720a688cb16aa44b3775799da)
Merged-In: I146415ad400827d0a798e27f34f098feb5e96422
Change-Id: I146415ad400827d0a798e27f34f098feb5e96422
| -rw-r--r-- | core/java/android/service/dreams/DreamService.java | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/core/java/android/service/dreams/DreamService.java b/core/java/android/service/dreams/DreamService.java index 2d461c6cf92e..d380522de643 100644 --- a/core/java/android/service/dreams/DreamService.java +++ b/core/java/android/service/dreams/DreamService.java @@ -1192,8 +1192,17 @@ public class DreamService extends Service implements Window.Callback { if (!flattenedString.contains("/")) { return new ComponentName(serviceInfo.packageName, flattenedString); } - - return ComponentName.unflattenFromString(flattenedString); + // Ensure that the component is from the same package as the dream service. If not, + // treat the component as invalid and return null instead. + final ComponentName cn = ComponentName.unflattenFromString(flattenedString); + if (cn == null) return null; + if (!cn.getPackageName().equals(serviceInfo.packageName)) { + Log.w(TAG, + "Inconsistent package name in component: " + cn.getPackageName() + + ", should be: " + serviceInfo.packageName); + return null; + } + return cn; } /** |