diff options
| author | William Leshner <wleshner@google.com> | 2023-11-04 00:10:33 +0000 |
|---|---|---|
| committer | Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> | 2023-11-04 00:10:33 +0000 |
| commit | 9a24157c26a2f55c60a7eb8808c25dcc9d8b2fb8 (patch) | |
| tree | 4f6ced8886f4733141e064f44bfaf68b34ddf190 | |
| parent | 944a0d9dedc3c7c8b0cc8b617304df9b21759a9b (diff) | |
| parent | 43bc68b84561eaaaaab464c60afb49ae5ed5f05b (diff) | |
| download | base-9a24157c26a2f55c60a7eb8808c25dcc9d8b2fb8.tar.gz | |
Merge "Fix vulnerability that allowed attackers to start arbitary activities" into rvc-dev am: 6b55e12830 am: eebdc4c3b6 am: 66864c7ac8 am: 43bc68b845
Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/25238611
Change-Id: Ib6ab3078686822e62a4629d986d2369643d1aa79
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
| -rw-r--r-- | packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java b/packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java index ab7b54d98285..beadd821957b 100644 --- a/packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java +++ b/packages/SettingsLib/src/com/android/settingslib/dream/DreamBackend.java @@ -351,7 +351,17 @@ public class DreamBackend { if (cn != null && cn.indexOf('/') < 0) { cn = resolveInfo.serviceInfo.packageName + "/" + cn; } - return cn == null ? null : ComponentName.unflattenFromString(cn); + // Ensure that the component is from the same package as the dream service. If not, + // treat the component as invalid and return null instead. + final ComponentName result = cn != null ? ComponentName.unflattenFromString(cn) : null; + if (result != null + && !result.getPackageName().equals(resolveInfo.serviceInfo.packageName)) { + Log.w(TAG, + "Inconsistent package name in component: " + result.getPackageName() + + ", should be: " + resolveInfo.serviceInfo.packageName); + return null; + } + return result; } private static void logd(String msg, Object... args) { |