tequilaOS/platform_system_core
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix vold vulnerability in FrameworkListener am: 470484d2a2 am: e9e046df6c

Browse source 
am: 109024f74a

Change-Id: Ia6e8dca36bc28d442a6e374ecf033b79176f4b93
This commit is contained in:
Connor O'Brien 2016-08-19 22:11:27 +00:00 committed by android-build-merger
commit b906ad88b9
2 changed files with 15 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
include/sysutils/FrameworkListener.h
View file

@ -32,6 +32,7 @@ private:
int mCommandCount;
bool mWithSeq;
FrameworkCommandCollection *mCommands;
bool mSkipToNextNullByte;
public:
FrameworkListener(const char *socketName);

17
libsysutils/src/FrameworkListener.cpp
View file

@ -49,6 +49,7 @@ void FrameworkListener::init(const char *socketName UNUSED, bool withSeq) {
errorRate = 0;
mCommandCount = 0;
mWithSeq = withSeq;
mSkipToNextNullByte = false;
}
bool FrameworkListener::onDataAvailable(SocketClient *c) {
@ -59,10 +60,15 @@ bool FrameworkListener::onDataAvailable(SocketClient *c) {
if (len < 0) {
SLOGE("read() failed (%s)", strerror(errno));
return false;
} else if (!len)
} else if (!len) {
return false;
if(buffer[len-1] != '\0')
} else if (buffer[len-1] != '\0') {
SLOGW("String is not zero-terminated");
android_errorWriteLog(0x534e4554, "29831647");
c->sendMsg(500, "Command too large for buffer", false);
mSkipToNextNullByte = true;
return false;
}
int offset = 0;
int i;
@ -70,11 +76,16 @@ bool FrameworkListener::onDataAvailable(SocketClient *c) {
for (i = 0; i < len; i++) {
if (buffer[i] == '\0') {
/* IMPORTANT: dispatchCommand() expects a zero-terminated string */
dispatchCommand(c, buffer + offset);
if (mSkipToNextNullByte) {
mSkipToNextNullByte = false;
} else {
dispatchCommand(c, buffer + offset);
}
offset = i + 1;
}
}
mSkipToNextNullByte = false;
return true;
}