OSDN Git Service

Fix security hole in GateKeeperResponse.
authorCharles He <qiurui@google.com>
Fri, 14 Jul 2017 13:41:06 +0000 (14:41 +0100)
committerJP Sugarbroad <jpsugar@google.com>
Mon, 21 Aug 2017 23:04:29 +0000 (16:04 -0700)
commitdcb83b3365657e3269e9120dc571f948e07fa85e
treefe6e8ecbe5ed17c3971f205ea587c39896d4149c
parent3fa9fd94e7a3d1054182e03b90f3ae5281806093
Fix security hole in GateKeeperResponse.

GateKeeperResponse has inconsistent writeToParcel() and
createFromParcel() methods, making it possible for a malicious app to
create a Bundle that changes contents after reserialization. Such
Bundles can be used to execute Intents with system privileges.

This CL changes writeToParcel() to make serialization and
deserialization consistent, thus fixing the issue.

Bug: 62998805
Test: use the debug app (see bug)
Change-Id: Ie1c64172c454c3a4b7a0919eb3454f0e38efcd09
(cherry picked from commit e74cae8f7c3e6b12f2bf2b75427ee8f5b53eca3c)
core/java/android/service/gatekeeper/GateKeeperResponse.java