From e74cae8f7c3e6b12f2bf2b75427ee8f5b53eca3c Mon Sep 17 00:00:00 2001 From: Charles He Date: Fri, 14 Jul 2017 14:41:06 +0100 Subject: [PATCH] Fix security hole in GateKeeperResponse. GateKeeperResponse has inconsistent writeToParcel() and createFromParcel() methods, making it possible for a malicious app to create a Bundle that changes contents after reserialization. Such Bundles can be used to execute Intents with system privileges. This CL changes writeToParcel() to make serialization and deserialization consistent, thus fixing the issue. Bug: 62998805 Test: use the debug app (see bug) Change-Id: Ie1c64172c454c3a4b7a0919eb3454f0e38efcd09 --- core/java/android/service/gatekeeper/GateKeeperResponse.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/core/java/android/service/gatekeeper/GateKeeperResponse.java b/core/java/android/service/gatekeeper/GateKeeperResponse.java index a512957d6040..6ca6d8ac7100 100644 --- a/core/java/android/service/gatekeeper/GateKeeperResponse.java +++ b/core/java/android/service/gatekeeper/GateKeeperResponse.java @@ -85,6 +85,8 @@ public final class GateKeeperResponse implements Parcelable { if (mPayload != null) { dest.writeInt(mPayload.length); dest.writeByteArray(mPayload); + } else { + dest.writeInt(0); } } } -- 2.11.0