diff options
| author | Michael Wachenschwanz <mwachens@google.com> | 2019-05-15 22:58:15 -0700 |
|---|---|---|
| committer | Nikoli Cartagena <dargeren@google.com> | 2019-06-10 14:52:34 -0700 |
| commit | b8b11c7913dd2587187176568a87d3c0642c1c38 (patch) | |
| tree | 1e7abbcac4aff2d92468d61ff2485cfb1530b765 | |
| parent | 331c07f85a7e7ad538afa6c13f1e5b68337f8f5a (diff) | |
| download | base-b8b11c7913dd2587187176568a87d3c0642c1c38.tar.gz | |
Clear the Parcel before writing an exception during a transactionandroid-8.0.0_r37
This prevents any object data from being accidentally overwritten by the
exception, which could cause unexpected malformed objects to be sent
across the transaction.
Test: atest CtsOsTestCases:ParcelTest#testExceptionOverwritesObject
Bug: 34175893
Change-Id: Iaf80a0ad711762992b8ae60f76d861c97a403013
Merged-In: Iaf80a0ad711762992b8ae60f76d861c97a403013
(cherry picked from commit f8ef5bcf21c87d8617f5e11810cc94350298d114)
| -rw-r--r-- | core/java/android/os/Binder.java | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/core/java/android/os/Binder.java b/core/java/android/os/Binder.java index ff0bc69ed325..b9e21196c73d 100644 --- a/core/java/android/os/Binder.java +++ b/core/java/android/os/Binder.java @@ -683,6 +683,8 @@ public class Binder implements IBinder { Log.w(TAG, "Caught a RuntimeException from the binder stub implementation.", e); } } else { + // Clear the parcel before writing the exception + reply.setDataSize(0); reply.setDataPosition(0); reply.writeException(e); } |