diff options
| author | Michael Wachenschwanz <mwachens@google.com> | 2018-04-17 16:52:40 -0700 |
|---|---|---|
| committer | android-build-team Robot <android-build-team-robot@google.com> | 2018-06-04 21:52:43 +0000 |
| commit | 8bd418fc8c00fbfcef0cb45b2aca6486f7324796 (patch) | |
| tree | e7ca1da7bc4cdb7a7533f5b4a8273e07714c00db | |
| parent | 07a6b21a804ee32a9d683e913f8a402a747fedc1 (diff) | |
| download | native-8bd418fc8c00fbfcef0cb45b2aca6486f7324796.tar.gz | |
Increment when attempting to read protected Parcel Data
Make sure to increment the parcel data position even when trying to
improperly read from protected data
Bug: 29833520
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtection
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtectionIncrements
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtection
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtectionIncrements
Change-Id: Ie4aae6277fc5f5c924f603d9828c3a608998b986
Merged-In: Ie4aae6277fc5f5c924f603d9828c3a608998b986
(cherry picked from commit 6a825e8ad1a3928dd872bb7c3fbcd94784d77267)
| -rw-r--r-- | libs/binder/Parcel.cpp | 20 |
1 files changed, 17 insertions, 3 deletions
diff --git a/libs/binder/Parcel.cpp b/libs/binder/Parcel.cpp index 44357c3653..3fafbb8d1b 100644 --- a/libs/binder/Parcel.cpp +++ b/libs/binder/Parcel.cpp @@ -1535,7 +1535,12 @@ status_t Parcel::read(void* outData, size_t len) const && len <= pad_size(len)) { if (mObjectsSize > 0) { status_t err = validateReadData(mDataPos + pad_size(len)); - if(err != NO_ERROR) return err; + if(err != NO_ERROR) { + // Still increment the data position by the expected length + mDataPos += pad_size(len); + ALOGV("read Setting data pos of %p to %zu", this, mDataPos); + return err; + } } memcpy(outData, mData+mDataPos, len); mDataPos += pad_size(len); @@ -1557,7 +1562,12 @@ const void* Parcel::readInplace(size_t len) const && len <= pad_size(len)) { if (mObjectsSize > 0) { status_t err = validateReadData(mDataPos + pad_size(len)); - if(err != NO_ERROR) return NULL; + if(err != NO_ERROR) { + // Still increment the data position by the expected length + mDataPos += pad_size(len); + ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos); + return NULL; + } } const void* data = mData+mDataPos; @@ -1575,7 +1585,11 @@ status_t Parcel::readAligned(T *pArg) const { if ((mDataPos+sizeof(T)) <= mDataSize) { if (mObjectsSize > 0) { status_t err = validateReadData(mDataPos + sizeof(T)); - if(err != NO_ERROR) return err; + if(err != NO_ERROR) { + // Still increment the data position by the expected length + mDataPos += sizeof(T); + return err; + } } const void* data = mData+mDataPos; |