OSDN Git Service

Fix security hole in GateKeeperResponse.
authorCharles He <qiurui@google.com>
Fri, 14 Jul 2017 13:41:06 +0000 (14:41 +0100)
committerCharles He <qiurui@google.com>
Fri, 14 Jul 2017 14:36:11 +0000 (14:36 +0000)
commite74cae8f7c3e6b12f2bf2b75427ee8f5b53eca3c
tree8eb2a10327125f22bba5979cb273357821b929d0
parent111a2c79874f826edd1fe08ecc5c6e8513eb6093
Fix security hole in GateKeeperResponse.

GateKeeperResponse has inconsistent writeToParcel() and
createFromParcel() methods, making it possible for a malicious app to
create a Bundle that changes contents after reserialization. Such
Bundles can be used to execute Intents with system privileges.

This CL changes writeToParcel() to make serialization and
deserialization consistent, thus fixing the issue.

Bug: 62998805
Test: use the debug app (see bug)
Change-Id: Ie1c64172c454c3a4b7a0919eb3454f0e38efcd09
core/java/android/service/gatekeeper/GateKeeperResponse.java