OSDN Git Service
Siarhei Vishniakou [Thu, 10 Aug 2017 22:18:37 +0000 (22:18 +0000)]
[automerger] DO NOT MERGE Remove window obscurement information. am:
edac95e737 am:
dda3bdf8a8 am:
3cd049ca28 skipped:
2564b9fdf5
Change-Id: I9340b61f66403d4a76aef61e8d5c523d46604f34
Siarhei Vishniakou [Thu, 10 Aug 2017 22:18:33 +0000 (22:18 +0000)]
[automerger] DO NOT MERGE Remove window obscurement information. am:
edac95e737 am:
dda3bdf8a8 am:
3cd049ca28
Change-Id: I75bc0db5679a6ae55c647b31f206755128fa47f7
Siarhei Vishniakou [Thu, 10 Aug 2017 22:18:29 +0000 (22:18 +0000)]
[automerger] DO NOT MERGE Remove window obscurement information. am:
edac95e737 am:
dda3bdf8a8
Change-Id: I313f92051e52e6b1b0f3d2f564781c66e6ad4918
Siarhei Vishniakou [Thu, 10 Aug 2017 22:18:25 +0000 (22:18 +0000)]
[automerger] DO NOT MERGE Remove window obscurement information. am:
edac95e737
Change-Id: I61e9a4e826ef2cafd73ad3591f3a3560a7002253
Siarhei Vishniakou [Fri, 4 Aug 2017 19:37:47 +0000 (12:37 -0700)]
DO NOT MERGE Remove window obscurement information.
If ACTION_OUTSIDE_EVENTS contain information about whether the touch is
obscured, then a pattern of invisible, untouchable, unfocusable
SYSTEM_ALERT_WINDOWS can be placed across the screen to determine
approximate locations of touch events without the user knowing.
Bug:
31097064
Test: cts-tradefed run cts --class android.security.cts.MotionEventTest
Change-Id: Iebbb68231cbb76f87241201e7640a1fe3e188625
Siarhei Vishniakou [Tue, 1 Aug 2017 03:33:41 +0000 (20:33 -0700)]
DO NOT MERGE Remove window obscurement information.
If ACTION_OUTSIDE_EVENTS contain information about whether the touch is
obscured, then a pattern of invisible, untouchable, unfocusable
SYSTEM_ALERT_WINDOWS can be placed across the screen to determine
approximate locations of touch events without the user knowing.
Bug:
31097064
Test: cts-tradefed run cts --class android.security.cts.MotionEventTest
Change-Id: Ie30dcc2402d5422a19a43ffe7d1411d91681efc2
Mathias Agopian [Tue, 4 Apr 2017 00:14:31 +0000 (17:14 -0700)]
fix race condition that can cause a use after free
Backported from
12a0ccd6f7201bac706d903ac3f436c4358fe203.
Bug:
33004354
Test: manual
Change-Id: I9b38ee644b02268c9b995a330db758aa2e568399
Chia-I Wu [Tue, 16 May 2017 21:02:42 +0000 (21:02 +0000)]
Merge "libgui: check for invalid slot in attachBuffer" into lmp-dev am:
af33c978c8 am:
396cc342a7 am:
91a7e47a53 am:
6a9b41dc22 am:
1f8b90126a am:
0544fa4580
am:
788ff8c16f
Change-Id: I5623d15da983b9277ab968d63b537ce396ad007c
Dan Stoza [Tue, 16 May 2017 21:02:17 +0000 (21:02 +0000)]
Merge "libgui: Check slot received from IGBP in Surface" into lmp-dev am:
98e3c06010 am:
970bb51580 am:
78976cea8f am:
2fe15aa6f0 am:
cce83f15e5 am:
9a44ee0742
am:
787aa48f41
Change-Id: I96e45ad313a7ea1233972ac80a1c8c85f6e64618
Chia-I Wu [Tue, 16 May 2017 20:59:04 +0000 (20:59 +0000)]
Merge "libgui: check for invalid slot in attachBuffer" into lmp-dev am:
af33c978c8 am:
396cc342a7 am:
91a7e47a53 am:
6a9b41dc22 am:
1f8b90126a
am:
0544fa4580
Change-Id: Id6d055a523eed1f96e1373d4f3fede43551a8abe
Dan Stoza [Tue, 16 May 2017 20:58:46 +0000 (20:58 +0000)]
Merge "libgui: Check slot received from IGBP in Surface" into lmp-dev am:
98e3c06010 am:
970bb51580 am:
78976cea8f am:
2fe15aa6f0 am:
cce83f15e5
am:
9a44ee0742
Change-Id: I79f6a2eb14d624b153244788267a16c752927e33
Chia-I Wu [Tue, 16 May 2017 20:56:04 +0000 (20:56 +0000)]
Merge "libgui: check for invalid slot in attachBuffer" into lmp-dev am:
af33c978c8 am:
396cc342a7 am:
91a7e47a53 am:
6a9b41dc22
am:
1f8b90126a
Change-Id: Iaf0fd93af8567520229a0a73fda8bd5fcc8091f1
Dan Stoza [Tue, 16 May 2017 20:55:47 +0000 (20:55 +0000)]
Merge "libgui: Check slot received from IGBP in Surface" into lmp-dev am:
98e3c06010 am:
970bb51580 am:
78976cea8f am:
2fe15aa6f0
am:
cce83f15e5
Change-Id: I82264d2033d6b098199321fd29c0d26017ec5359
Chia-I Wu [Tue, 16 May 2017 20:53:35 +0000 (20:53 +0000)]
Merge "libgui: check for invalid slot in attachBuffer" into lmp-dev am:
af33c978c8 am:
396cc342a7 am:
91a7e47a53
am:
6a9b41dc22
Change-Id: I03af2ccc0f7f671baa4ec9f7b9a3b55f8b377435
Dan Stoza [Tue, 16 May 2017 20:53:16 +0000 (20:53 +0000)]
Merge "libgui: Check slot received from IGBP in Surface" into lmp-dev am:
98e3c06010 am:
970bb51580 am:
78976cea8f
am:
2fe15aa6f0
Change-Id: I36fcc82af237645b61c69d70c574843a5b2753c8
Chia-I Wu [Tue, 16 May 2017 20:50:05 +0000 (20:50 +0000)]
Merge "libgui: check for invalid slot in attachBuffer" into lmp-dev am:
af33c978c8 am:
396cc342a7
am:
91a7e47a53
Change-Id: I198ba45e3005214e9cd41379d6f833297be93caf
Dan Stoza [Tue, 16 May 2017 20:49:46 +0000 (20:49 +0000)]
Merge "libgui: Check slot received from IGBP in Surface" into lmp-dev am:
98e3c06010 am:
970bb51580
am:
78976cea8f
Change-Id: I30e6a29474b6cf86f97961f527301837b35c8a36
Chia-I Wu [Tue, 16 May 2017 20:46:53 +0000 (20:46 +0000)]
Merge "libgui: check for invalid slot in attachBuffer" into lmp-dev am:
af33c978c8
am:
396cc342a7
Change-Id: Ic9f8bce011edd718580971059ae96b0d65c9fdda
Dan Stoza [Tue, 16 May 2017 20:45:35 +0000 (20:45 +0000)]
Merge "libgui: Check slot received from IGBP in Surface" into lmp-dev am:
98e3c06010
am:
970bb51580
Change-Id: I767956fd15f8be9aa30feb38ad11ec84e98a50bd
Chia-I Wu [Tue, 16 May 2017 20:41:35 +0000 (20:41 +0000)]
Merge "libgui: check for invalid slot in attachBuffer" into lmp-dev
am:
af33c978c8
Change-Id: I97f957bc5375d11cd034d4b06baa8636e7999f8c
Dan Stoza [Tue, 16 May 2017 20:41:16 +0000 (20:41 +0000)]
Merge "libgui: Check slot received from IGBP in Surface" into lmp-dev
am:
98e3c06010
Change-Id: I28774e185329082424a26cfccca4c95c7863e88f
Chia-I Wu [Tue, 16 May 2017 20:33:31 +0000 (20:33 +0000)]
Merge "libgui: check for invalid slot in attachBuffer" into lmp-dev
TreeHugger Robot [Tue, 16 May 2017 20:30:06 +0000 (20:30 +0000)]
Merge "libgui: Check slot received from IGBP in Surface" into lmp-dev
Chris Forbes [Tue, 16 May 2017 19:36:43 +0000 (19:36 +0000)]
Merge "ui: Fix bad size check in Fence::unflatten" into klp-dev am:
25556811f0 am:
71d3ef1340 am:
5c5ee81b0c am:
05df3a6f4d am:
81bab8081e am:
209ad9b6fe am:
d4cbd296d6 am:
593a1a217a am:
e3bc28ad88
am:
600e610344
Change-Id: I19dec89ef157c3a61300622c4425d5f6801f139e
Chris Forbes [Tue, 16 May 2017 19:33:42 +0000 (19:33 +0000)]
Merge "ui: Fix bad size check in Fence::unflatten" into klp-dev am:
25556811f0 am:
71d3ef1340 am:
5c5ee81b0c am:
05df3a6f4d am:
81bab8081e am:
209ad9b6fe am:
d4cbd296d6 am:
593a1a217a
am:
e3bc28ad88
Change-Id: I4ad5bf17fdca2bd0adee7a06150d595ef9b6a0fa
Chris Forbes [Tue, 16 May 2017 19:30:42 +0000 (19:30 +0000)]
Merge "ui: Fix bad size check in Fence::unflatten" into klp-dev am:
25556811f0 am:
71d3ef1340 am:
5c5ee81b0c am:
05df3a6f4d am:
81bab8081e am:
209ad9b6fe am:
d4cbd296d6
am:
593a1a217a
Change-Id: I6c50751f24fdc5756bd5d1357df184d2a08f3c08
Chris Forbes [Tue, 16 May 2017 19:27:40 +0000 (19:27 +0000)]
Merge "ui: Fix bad size check in Fence::unflatten" into klp-dev am:
25556811f0 am:
71d3ef1340 am:
5c5ee81b0c am:
05df3a6f4d am:
81bab8081e am:
209ad9b6fe
am:
d4cbd296d6
Change-Id: I3ddc8b4600015cd53d1a41b687518cdbbc7696b6
Chris Forbes [Tue, 16 May 2017 19:24:11 +0000 (19:24 +0000)]
Merge "ui: Fix bad size check in Fence::unflatten" into klp-dev am:
25556811f0 am:
71d3ef1340 am:
5c5ee81b0c am:
05df3a6f4d am:
81bab8081e
am:
209ad9b6fe
Change-Id: I31fe784570c5978faf7484b3f71a074523c0d33c
Chris Forbes [Tue, 16 May 2017 19:21:39 +0000 (19:21 +0000)]
Merge "ui: Fix bad size check in Fence::unflatten" into klp-dev am:
25556811f0 am:
71d3ef1340 am:
5c5ee81b0c am:
05df3a6f4d
am:
81bab8081e
Change-Id: I78509c86bada44d1d9f9c40e4d64a5120e4c7ab6
Chris Forbes [Tue, 16 May 2017 19:18:41 +0000 (19:18 +0000)]
Merge "ui: Fix bad size check in Fence::unflatten" into klp-dev am:
25556811f0 am:
71d3ef1340 am:
5c5ee81b0c
am:
05df3a6f4d
Change-Id: I50c771aee7375315ba6c6aa4029baacfe9c199d8
Chris Forbes [Tue, 16 May 2017 19:15:38 +0000 (19:15 +0000)]
Merge "ui: Fix bad size check in Fence::unflatten" into klp-dev am:
25556811f0 am:
71d3ef1340
am:
5c5ee81b0c
Change-Id: Ie7ec2067057ea2dbd4b9af0c93a00ba53879b72f
Chris Forbes [Tue, 16 May 2017 19:12:38 +0000 (19:12 +0000)]
Merge "ui: Fix bad size check in Fence::unflatten" into klp-dev am:
25556811f0
am:
71d3ef1340
Change-Id: I75797414173ebfb38eefe02ac0a635f10c59d883
Chris Forbes [Tue, 16 May 2017 19:10:08 +0000 (19:10 +0000)]
Merge "ui: Fix bad size check in Fence::unflatten" into klp-dev
am:
25556811f0
Change-Id: I5a267f8dccb75625fafd96e67bc0fbb9a2492ce7
Chris Forbes [Tue, 16 May 2017 19:00:54 +0000 (19:00 +0000)]
Merge "ui: Fix bad size check in Fence::unflatten" into klp-dev
Chris Forbes [Wed, 10 May 2017 20:12:00 +0000 (13:12 -0700)]
ui: Fix bad size check in Fence::unflatten
Differs slightly from mnc+ patch: GetFlattenedSize was fixed in mnc.
Test: Boot device, run poc from bug, observe no longer crashes
Bug:
37285689
Change-Id: Id8b851733b088cce0d07493fbf76e7e24f9299ad
Chia-I Wu [Mon, 15 May 2017 17:32:27 +0000 (10:32 -0700)]
libgui: check for invalid slot in attachBuffer
Bug:
37478824
Test: manual
Change-Id: I369337d53539bf7f7e3d925bccdae4045da1b404
Dan Stoza [Mon, 1 May 2017 23:31:53 +0000 (16:31 -0700)]
libgui: Check slot received from IGBP in Surface
Checks that the slot number received from mGraphicBufferProducer in
Surface::dequeueBuffer is on the interval [0, NUM_BUFFER_SLOTS) to
protect against a malicious BnGraphicBufferProducer.
Bug:
36991414
Change-Id: I1a76fd1bcce1c558f1c0c30f03638278288ed4fa
Dan Stoza [Mon, 15 May 2017 18:34:02 +0000 (18:34 +0000)]
libgui: Check slot received from IGBP in Surface am:
ac93b3a30e am:
7cb9cd3df2 am:
057ae95ab2 -s ours am:
bec844f6d4 am:
e7c7be2c17 am:
cc184e4209 am:
2c86168b51 am:
f4a1a4e7fd am:
1102b311c8
am:
f571b41457
Change-Id: I739439543fd954b15a6da5909a47873e9a6dd029
Dan Stoza [Mon, 15 May 2017 18:31:01 +0000 (18:31 +0000)]
libgui: Check slot received from IGBP in Surface am:
ac93b3a30e am:
7cb9cd3df2 am:
057ae95ab2 -s ours am:
bec844f6d4 am:
e7c7be2c17 am:
cc184e4209 am:
2c86168b51 am:
f4a1a4e7fd
am:
1102b311c8
Change-Id: I2fc05fc6415e981f3fe13770697c810309312729
Dan Stoza [Mon, 15 May 2017 18:28:01 +0000 (18:28 +0000)]
libgui: Check slot received from IGBP in Surface am:
ac93b3a30e am:
7cb9cd3df2 am:
057ae95ab2 -s ours am:
bec844f6d4 am:
e7c7be2c17 am:
cc184e4209 am:
2c86168b51
am:
f4a1a4e7fd
Change-Id: I7ecadb481757312b22c4b47a6f8040c0e7a18d72
Dan Stoza [Mon, 15 May 2017 18:25:00 +0000 (18:25 +0000)]
libgui: Check slot received from IGBP in Surface am:
ac93b3a30e am:
7cb9cd3df2 am:
057ae95ab2 -s ours am:
bec844f6d4 am:
e7c7be2c17 am:
cc184e4209
am:
2c86168b51
Change-Id: I82f10a43940d6038946f25870c8394900d5219fb
Dan Stoza [Mon, 15 May 2017 18:21:59 +0000 (18:21 +0000)]
libgui: Check slot received from IGBP in Surface am:
ac93b3a30e am:
7cb9cd3df2 am:
057ae95ab2 -s ours am:
bec844f6d4 am:
e7c7be2c17
am:
cc184e4209
Change-Id: I20d492d5b3728ccf2ef68695d54b79f1a3c8371a
Dan Stoza [Mon, 15 May 2017 18:19:31 +0000 (18:19 +0000)]
libgui: Check slot received from IGBP in Surface am:
ac93b3a30e am:
7cb9cd3df2 am:
057ae95ab2 -s ours am:
bec844f6d4
am:
e7c7be2c17
Change-Id: I79e844eff3739ea737d20f381da6fa4da9852015
Dan Stoza [Mon, 15 May 2017 18:16:30 +0000 (18:16 +0000)]
libgui: Check slot received from IGBP in Surface am:
ac93b3a30e am:
7cb9cd3df2 am:
057ae95ab2 -s ours
am:
bec844f6d4
Change-Id: I48d94557a005c4b0b46bf339ca685e9d1d231d97
Dan Stoza [Mon, 15 May 2017 18:13:30 +0000 (18:13 +0000)]
libgui: Check slot received from IGBP in Surface am:
ac93b3a30e am:
7cb9cd3df2
am:
057ae95ab2 -s ours
Change-Id: I2c6441b19650f31c7bbab9ce22191ae162ba9e58
Dan Stoza [Mon, 15 May 2017 18:02:29 +0000 (18:02 +0000)]
libgui: Check slot received from IGBP in Surface am:
ac93b3a30e
am:
7cb9cd3df2
Change-Id: Iff706258762cac4bfb7d97af7d365412d9ee661d
Dan Stoza [Mon, 15 May 2017 17:59:58 +0000 (17:59 +0000)]
libgui: Check slot received from IGBP in Surface
am:
ac93b3a30e
Change-Id: I6ab9bc7f577634c0bf23359b5eb60e6dd07e4854
Dan Stoza [Mon, 1 May 2017 23:31:53 +0000 (16:31 -0700)]
libgui: Check slot received from IGBP in Surface
Checks that the slot number received from mGraphicBufferProducer in
Surface::dequeueBuffer is on the interval [0, NUM_BUFFER_SLOTS) to
protect against a malicious BnGraphicBufferProducer.
Bug:
36991414
Change-Id: I1a76fd1bcce1c558f1c0c30f03638278288ed4fa
TreeHugger Robot [Thu, 2 Feb 2017 20:08:46 +0000 (20:08 +0000)]
Merge "Fix security vulnerability" into nyc-dev
Fabien Sanglard [Thu, 2 Feb 2017 01:49:06 +0000 (01:49 +0000)]
Fix security vulnerability am:
2ae83f4f62 am:
11ab583834 am:
ac2b87ac0f am:
132d0f2aef am:
3995674f24 am:
c7892d9d0b am:
cca3b79c32 am:
ebbf8a6b5a am:
5ba227f96e
am:
40cd915a54
Change-Id: Ib34c9d0e90e77565ab6d0d7fb805bb425964b5aa
Fabien Sanglard [Thu, 2 Feb 2017 01:46:34 +0000 (01:46 +0000)]
Fix security vulnerability am:
2ae83f4f62 am:
11ab583834 am:
ac2b87ac0f am:
132d0f2aef am:
3995674f24 am:
c7892d9d0b am:
cca3b79c32 am:
ebbf8a6b5a
am:
5ba227f96e
Change-Id: I9fc225ba640b4391d60380d7c588015c3e5516a7
Fabien Sanglard [Thu, 2 Feb 2017 01:43:34 +0000 (01:43 +0000)]
Fix security vulnerability am:
2ae83f4f62 am:
11ab583834 am:
ac2b87ac0f am:
132d0f2aef am:
3995674f24 am:
c7892d9d0b am:
cca3b79c32
am:
ebbf8a6b5a
Change-Id: Id8c91e714058b999805aa6da613a4343fecc1d6a
Fabien Sanglard [Thu, 2 Feb 2017 01:41:34 +0000 (01:41 +0000)]
Fix security vulnerability am:
2ae83f4f62 am:
11ab583834 am:
ac2b87ac0f am:
132d0f2aef am:
3995674f24 am:
c7892d9d0b
am:
cca3b79c32
Change-Id: I2e5da5ee33eb2757f360881e6ecc7dfd9fb67938
Fabien Sanglard [Thu, 2 Feb 2017 01:38:33 +0000 (01:38 +0000)]
Fix security vulnerability am:
2ae83f4f62 am:
11ab583834 am:
ac2b87ac0f am:
132d0f2aef am:
3995674f24
am:
c7892d9d0b
Change-Id: Ic59ba49542b907591f3e514ae0417ed82a5be7aa
Fabien Sanglard [Thu, 2 Feb 2017 01:36:33 +0000 (01:36 +0000)]
Fix security vulnerability am:
2ae83f4f62 am:
11ab583834 am:
ac2b87ac0f am:
132d0f2aef
am:
3995674f24
Change-Id: I979af2b40c8ee1b3820204cee5fa7e21e4906bf9
Fabien Sanglard [Thu, 2 Feb 2017 01:34:03 +0000 (01:34 +0000)]
Fix security vulnerability am:
2ae83f4f62 am:
11ab583834 am:
ac2b87ac0f
am:
132d0f2aef
Change-Id: If2aa999ec1f261ea34a6aa725241ea50226083ad
Fabien Sanglard [Thu, 2 Feb 2017 01:31:32 +0000 (01:31 +0000)]
Fix security vulnerability am:
2ae83f4f62 am:
11ab583834
am:
ac2b87ac0f
Change-Id: I3b249a9ec1820917dc015c72bd093535927c9ed6
Fabien Sanglard [Thu, 2 Feb 2017 01:29:02 +0000 (01:29 +0000)]
Fix security vulnerability am:
2ae83f4f62
am:
11ab583834
Change-Id: I09ec85b9f83e1f4458940415cd07f6fca725c552
Fabien Sanglard [Thu, 2 Feb 2017 01:27:03 +0000 (01:27 +0000)]
Fix security vulnerability
am:
2ae83f4f62
Change-Id: Ie0590dbb8429b5b289f3095055abdc8d29b95a7f
Fabien Sanglard [Thu, 19 Jan 2017 19:13:20 +0000 (11:13 -0800)]
Fix security vulnerability
Test: hammerhead
Bug:
32628763
Change-Id: I19a81b63fffee8f323a5925c7e8633fbd640b91c
Fabien Sanglard [Thu, 19 Jan 2017 00:43:18 +0000 (16:43 -0800)]
Fix security vulnerability
Change-Id: I4c9ea3a3177131fa29d2561da71ef18bec3af108
Test: angler, marlin
Bug:
32628763
Fabien Sanglard [Tue, 6 Dec 2016 19:22:20 +0000 (19:22 +0000)]
Merge "Fix security vulneratibly
31960359" into nyc-dev
Christopher Tate [Tue, 6 Dec 2016 00:17:19 +0000 (00:17 +0000)]
resolve merge conflicts of
13c5c34 to mnc-dev am:
79b74d787d am:
abe293b950 am:
02e4440eab
am:
953c05276e
Change-Id: If6e16f080e701171d7c9b69adbeaab3a6910b63a
Christopher Tate [Tue, 6 Dec 2016 00:13:48 +0000 (00:13 +0000)]
resolve merge conflicts of
13c5c34 to mnc-dev am:
79b74d787d am:
abe293b950
am:
02e4440eab
Change-Id: I66e7e982176555f09bf298325754d708ef0ecac0
Christopher Tate [Tue, 6 Dec 2016 00:09:47 +0000 (00:09 +0000)]
resolve merge conflicts of
13c5c34 to mnc-dev am:
79b74d787d
am:
abe293b950
Change-Id: I7f8ce6dbb313d592b97b41a982e629680eba36c4
Christopher Tate [Tue, 6 Dec 2016 00:06:18 +0000 (00:06 +0000)]
resolve merge conflicts of
13c5c34 to mnc-dev
am:
79b74d787d
Change-Id: I383dde0596fe37282db3bb62f7ad65e763fdd1dc
Fabien Sanglard [Mon, 5 Dec 2016 23:06:29 +0000 (15:06 -0800)]
Fix security vulneratibly
31960359
BufferQueueCore features a variable mLastQueuedSlot which is not
initialized in its constructor resulting in security vulnerability
Bug:
31960359
Change-Id: If892f59f6288d8b81b1e312995832a20c8341494
Tests: Manually on Angler
Christopher Tate [Mon, 5 Dec 2016 22:10:47 +0000 (14:10 -0800)]
resolve merge conflicts of
13c5c34 to mnc-dev
Change-Id: I7f57cde153648f48ff038400aa437b76971d4771
Christopher Tate [Mon, 5 Dec 2016 21:23:36 +0000 (21:23 +0000)]
Correct overflow check in Parcel resize code am:
8b64307e95
am:
ed6937ae2c
Change-Id: I9ea154fd1f2ca3a69f756066fb49efc99e889224
Christopher Tate [Mon, 5 Dec 2016 21:20:07 +0000 (21:20 +0000)]
Correct overflow check in Parcel resize code
am:
8b64307e95
Change-Id: I371fb7c6aaf34d44d69c740eea95fe3ba125164a
Christopher Tate [Thu, 3 Nov 2016 20:32:41 +0000 (13:32 -0700)]
Correct overflow check in Parcel resize code
Bug
31929765
Change-Id: Ie27b9945f1de056624668869bdf9a5578abff467
Casey Dahlin [Tue, 15 Nov 2016 23:40:20 +0000 (23:40 +0000)]
Merge "Fix integer overflow in unsafeReadTypedVector" into nyc-dev
Fabien Sanglard [Tue, 15 Nov 2016 01:23:50 +0000 (01:23 +0000)]
Fix SF security vulnerability:
32660278 am:
2d8a2432e0 am:
e5c91fe2e2 am:
9d14ab5409 am:
275b2347ef am:
aff7827b4f am:
c8684d517a
am:
57dbf1c224
Change-Id: I5f91ea6e826a24d37bf8c7f7cbcc49a235532a14
Fabien Sanglard [Tue, 15 Nov 2016 01:17:50 +0000 (01:17 +0000)]
Fix SF security vulnerability:
32660278 am:
2d8a2432e0 am:
e5c91fe2e2 am:
9d14ab5409 am:
275b2347ef am:
aff7827b4f
am:
c8684d517a
Change-Id: I7d37baee66a7a16cb77e227b66ba93bc87119810
Fabien Sanglard [Tue, 15 Nov 2016 01:10:20 +0000 (01:10 +0000)]
Fix SF security vulnerability:
32660278 am:
2d8a2432e0 am:
e5c91fe2e2 am:
9d14ab5409 am:
275b2347ef
am:
aff7827b4f
Change-Id: I2a759e2ecdf1c67cb764a9279da23386cfb54914
Fabien Sanglard [Tue, 15 Nov 2016 01:10:20 +0000 (01:10 +0000)]
Fix SF security vulnerability:
32706020 am:
d073eb7a3f am:
230b943c6b am:
a928cc7169
am:
0517da2c5a
Change-Id: Ie25ecd20988d9aa8d3f59b07d00b80c0a18d5e3a
Fabien Sanglard [Tue, 15 Nov 2016 01:02:50 +0000 (01:02 +0000)]
Fix SF security vulnerability:
32706020 am:
d073eb7a3f am:
230b943c6b
am:
a928cc7169
Change-Id: I682597ada156253e34ef067ae565d656c6bb39f7
Fabien Sanglard [Tue, 15 Nov 2016 01:02:49 +0000 (01:02 +0000)]
Fix SF security vulnerability:
32660278 am:
2d8a2432e0 am:
e5c91fe2e2 am:
9d14ab5409
am:
275b2347ef
Change-Id: Iae0109ec3bddd6f71bab1759003a34e75270f6d4
Fabien Sanglard [Tue, 15 Nov 2016 00:55:19 +0000 (00:55 +0000)]
Fix SF security vulnerability:
32660278 am:
2d8a2432e0 am:
e5c91fe2e2
am:
9d14ab5409
Change-Id: I0ed8d425157308f35b43818a9592267c06cdc807
Fabien Sanglard [Tue, 15 Nov 2016 00:55:19 +0000 (00:55 +0000)]
Fix SF security vulnerability:
32706020 am:
d073eb7a3f
am:
230b943c6b
Change-Id: I439ff370c0a353bb9a0adc14a39aedd1ec5a783d
Fabien Sanglard [Tue, 15 Nov 2016 00:47:19 +0000 (00:47 +0000)]
Fix SF security vulnerability:
32660278 am:
2d8a2432e0
am:
e5c91fe2e2
Change-Id: I0c2becbd05d41fae542a1c68b6f0f26b0f10a15a
Fabien Sanglard [Tue, 15 Nov 2016 00:47:18 +0000 (00:47 +0000)]
Fix SF security vulnerability:
32706020
am:
d073eb7a3f
Change-Id: I5b7bf4ecee39de868b9c275531a6f11e65d1c3fd
Fabien Sanglard [Tue, 15 Nov 2016 00:39:18 +0000 (00:39 +0000)]
Fix SF security vulnerability:
32660278
am:
2d8a2432e0
Change-Id: Ia5f419d7d113692f5d52b483f70ca09589333e13
Fabien Sanglard [Tue, 8 Nov 2016 23:35:02 +0000 (15:35 -0800)]
Fix SF security vulnerability:
32706020
Because of lack of mutex lock when get mConsumerName, if one thread
getConsumerName, another thread setConsumerName frequently, an UAF will
be triggered.
Change-Id: Id1bbf0d15de6d16def2f54ecade385058cda3b65
Test: Marling with poc provided in bug report.
Bug:
32706020
Fabien Sanglard [Tue, 8 Nov 2016 23:31:32 +0000 (15:31 -0800)]
Fix SF security vulnerability:
32660278
Because of lack of mutex lock when get mSidebandStream, if one thread
getSidebandStream, another thread setSidebandStream frequently, an UAF
will be triggered.
Bug:
32660278
Test: Marlin device with poc
Change-Id: Idbcf0976ce2db682d0f13455105c45a5c7481a45
Casey Dahlin [Thu, 27 Oct 2016 00:18:25 +0000 (17:18 -0700)]
Fix integer overflow in unsafeReadTypedVector
Passing a size to std::vector that is too big causes it to silently
under-allocate when exceptions are disabled, leaving us open to an OOB
write. We check the bounds and the resulting size now to verify
allocation succeeds.
Test: Verified reproducer attached to bug no longer crashes Camera
service.
Bug:
31677614
Change-Id: I064b1442838032d93658f8bf63b7aa6d021c99b7
Eino-Ville Talvala [Fri, 22 Jul 2016 00:06:58 +0000 (17:06 -0700)]
DO NOT MERGE ANYWHERE: BufferQueue consumers: Add discardFreeBuffer method
This method releases all free buffers owned by the buffer queue,
in order to save memory (at the cost of potential future
reallocation of buffers).
Bug:
28695173
Change-Id: I458d10373e639e3144faf673af2ba01aca36e65a
Arve Hjnnevg [Fri, 19 Aug 2016 01:15:05 +0000 (01:15 +0000)]
ServiceManager: Allow system services running as secondary users to add services am:
e6bbe69ba7 am:
2cb14836ac am:
c29c3734af am:
ce0e72911c am:
2c39ea1025 am:
fa5aafc9f3 am:
1f36bcd2ba
am:
75469c1fc9
Change-Id: Icbe1e240a365b6f473ee060cdec384db3b49db24
Arve Hjnnevg [Fri, 19 Aug 2016 01:11:01 +0000 (01:11 +0000)]
ServiceManager: Allow system services running as secondary users to add services am:
e6bbe69ba7 am:
2cb14836ac am:
c29c3734af am:
ce0e72911c am:
2c39ea1025 am:
fa5aafc9f3
am:
1f36bcd2ba
Change-Id: Ic4225509044c66a55910b827e8076cf20c4b5bba
Arve Hjnnevg [Fri, 19 Aug 2016 01:07:30 +0000 (01:07 +0000)]
ServiceManager: Allow system services running as secondary users to add services am:
e6bbe69ba7 am:
2cb14836ac am:
c29c3734af am:
ce0e72911c am:
2c39ea1025
am:
fa5aafc9f3
Change-Id: I2b83c66f04f7dbfb1740d525ba6d424c9ea42c2b
Arve Hjnnevg [Fri, 19 Aug 2016 01:04:30 +0000 (01:04 +0000)]
ServiceManager: Allow system services running as secondary users to add services am:
e6bbe69ba7 am:
2cb14836ac am:
c29c3734af am:
ce0e72911c
am:
2c39ea1025
Change-Id: I355431fb0c566965759cd3d07d481c475cb494d0
Arve Hjnnevg [Fri, 19 Aug 2016 01:01:29 +0000 (01:01 +0000)]
ServiceManager: Allow system services running as secondary users to add services am:
e6bbe69ba7 am:
2cb14836ac am:
c29c3734af
am:
ce0e72911c
Change-Id: I2c36fdb4c92359a03af1c8a563d4d73b9e2898a2
Arve Hjnnevg [Fri, 19 Aug 2016 00:58:34 +0000 (00:58 +0000)]
ServiceManager: Allow system services running as secondary users to add services am:
e6bbe69ba7 am:
2cb14836ac
am:
c29c3734af
Change-Id: I72992d6662bbace5cecce2b96389139c96d2e181
Arve Hjnnevg [Fri, 19 Aug 2016 00:49:29 +0000 (00:49 +0000)]
ServiceManager: Allow system services running as secondary users to add services am:
e6bbe69ba7
am:
2cb14836ac
Change-Id: Ia7deecedc7eff4fb35742ba9c7475ca32ecf48aa
Arve Hjnnevg [Fri, 19 Aug 2016 00:46:28 +0000 (00:46 +0000)]
ServiceManager: Allow system services running as secondary users to add services
am:
e6bbe69ba7
Change-Id: Iebb7be5ff42026adb2ff2d2b610902b995acdbc0
Arve Hjønnevåg [Thu, 18 Aug 2016 22:42:35 +0000 (15:42 -0700)]
ServiceManager: Allow system services running as secondary users to add services
This should be reverted when all system services have been cleaned up to not
do this. A process looking up a service while running in the background will
see the service registered by the active user (assuming the service is
registered on every user switch), not the service registered by the user that
the process itself belongs to.
BUG:
30795333
Change-Id: I1b74d58be38ed358f43c163692f9e704f8f31dbe
Arve Hjnnevg [Tue, 9 Aug 2016 21:18:53 +0000 (21:18 +0000)]
DO NOT MERGE ServiceManager: Restore basic uid check am:
eb304f0a36 -s ours am:
a82f82293a am:
1c220583e4 am:
ce472fbb54 -s ours am:
e8cb9c8982 am:
1414d7b372 am:
b8d937caeb
am:
1864a8748d -s ours
Change-Id: I2e022f5c528ded283a40ad3e3a4ac230070a242b
Arve Hjnnevg [Tue, 9 Aug 2016 21:16:23 +0000 (21:16 +0000)]
DO NOT MERGE ServiceManager: Restore basic uid check am:
eb304f0a36 -s ours am:
a82f82293a am:
1c220583e4 am:
ce472fbb54 -s ours am:
e8cb9c8982 am:
1414d7b372
am:
b8d937caeb
Change-Id: I82f6a95334c5c8e484260f120b54ac1d386274da
Arve Hjnnevg [Tue, 9 Aug 2016 21:13:23 +0000 (21:13 +0000)]
DO NOT MERGE ServiceManager: Restore basic uid check am:
eb304f0a36 -s ours am:
a82f82293a am:
1c220583e4 am:
ce472fbb54 -s ours am:
e8cb9c8982
am:
1414d7b372
Change-Id: I50541ba686cafded699568f710627bf3e4f8aa1d
Arve Hjnnevg [Tue, 9 Aug 2016 21:10:26 +0000 (21:10 +0000)]
DO NOT MERGE ServiceManager: Restore basic uid check am:
eb304f0a36 -s ours am:
a82f82293a am:
1c220583e4 am:
ce472fbb54 -s ours
am:
e8cb9c8982
Change-Id: I9445235baf1ea98e3e47af3034fa49b0593ae1b2
OSDN Git Service
