diff options
author | Michael Wachenschwanz <mwachens@google.com> | 2018-08-24 21:50:35 -0700 |
---|---|---|
committer | android-build-team Robot <android-build-team-robot@google.com> | 2018-09-10 23:20:02 +0000 |
commit | 6a947f048a76a5936fd2b693e01f849aef22c907 (patch) | |
tree | 54326e3b168832fe34d393dcd4f709c7a2b000cc | |
parent | 8e81142af3dceb913ca50f67df3ded84233f932a (diff) | |
download | base-6a947f048a76a5936fd2b693e01f849aef22c907.tar.gz |
Verify number of Map entries written to Parcel
Make sure the number of entries written by Parcel#writeMapInternal
matches the size written. If a mismatch were allowed, an exploitable
scenario could occur where the data read from the Parcel would not
match the data written.
Fixes: 112859604
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest
Change-Id: I325d08a8b66b6e80fe76501359c41b6656848607
Merged-In: I325d08a8b66b6e80fe76501359c41b6656848607
(cherry picked from commit 057a01d1f38e9b46d3faa4059fdd7c8717681ea0)
-rw-r--r-- | core/java/android/os/Parcel.java | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/core/java/android/os/Parcel.java b/core/java/android/os/Parcel.java index 514292872e90..460f12510d45 100644 --- a/core/java/android/os/Parcel.java +++ b/core/java/android/os/Parcel.java @@ -835,11 +835,19 @@ public final class Parcel { return; } Set<Map.Entry<String,Object>> entries = val.entrySet(); - writeInt(entries.size()); + int size = entries.size(); + writeInt(size); + for (Map.Entry<String,Object> e : entries) { writeValue(e.getKey()); writeValue(e.getValue()); + size--; } + + if (size != 0) { + throw new BadParcelableException("Map size does not match number of entries!"); + } + } /** |