Fix exploit where can hide the fact that a location was mocked am: a206a0f17e am: d417e54872 (0a8978f0) · Commits · e / os / android_frameworks_base

services/core/java/com/android/server/LocationManagerService.java

+16 −1

Original line number	Diff line number	Diff line
		@@ -85,6 +85,8 @@ import android.os.UserHandle;
		import android.os.UserManager;
		import android.os.WorkSource;
		import android.provider.Settings;
		import android.text.TextUtils;
		import android.util.EventLog;
		import android.util.Log;
		import android.util.Slog;

		@@ -2432,9 +2434,22 @@ public class LocationManagerService extends ILocationManager.Stub {
		if (mockProvider == null) {
		throw new IllegalArgumentException("Provider \"" + provider + "\" unknown");
		}

		// Ensure that the location is marked as being mock. There's some logic to do this in
		// handleLocationChanged(), but it fails if loc has the wrong provider (bug 33091107).
		Location mock = new Location(loc);
		mock.setIsFromMockProvider(true);

		if (!TextUtils.isEmpty(loc.getProvider()) && !provider.equals(loc.getProvider())) {
		// The location has an explicit provider that is different from the mock provider
		// name. The caller may be trying to fool us via bug 33091107.
		EventLog.writeEvent(0x534e4554, "33091107", Binder.getCallingUid(),
		provider + "!=" + loc.getProvider());
		}

		// clear calling identity so INSTALL_LOCATION_PROVIDER permission is not required
		long identity = Binder.clearCallingIdentity();
		mockProvider.setLocation(loc);
		mockProvider.setLocation(mock);
		Binder.restoreCallingIdentity(identity);
		}
		}