Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 14d8d682 authored by Youngha Park's avatar Youngha Park
Browse files

Check intent action in OMS.PackageReceiver for secure coding 



NullPointerException occurs when OMS receives an intent with null action.
In constructor of OverlayManagerService, OMS.PackageReceiver is registered
with data scheme "package".
If a malicious app send broadcast intent only with data scheme "package",
NPE occurs because OMS.PackageReceiver does not check
whether intent.getAction() is null or not.
So add a logic to ignore intent with null action for secure coding.

Test: send broadcast without action like below.
 Intent intent = new Intent();
 Uri uri = Uri.parse("package:com.test");
 intent.setData(uri);
 intent.addFlags(0x01000000);
 sendBroadcast(intent);

Change-Id: I654f54a8a685de2ab985b87f53ad07c4e27db09d
Signed-off-by: default avatarYoungha Park <yh007.park@samsung.com>
parent 35ba945c

services/core/java/com/android/server/om/OverlayManagerService.java

+6 −1
Original line number Diff line number Diff line
@@ -321,6 +321,11 @@ public final class OverlayManagerService extends SystemService { 
    private final class PackageReceiver extends BroadcastReceiver {

        @Override

        public void onReceive(@NonNull final Context context, @NonNull final Intent intent) {

            final String action = intent.getAction();

            if (action == null) {

                Slog.e(TAG, "Cannot handle package broadcast with null action");

                return;

            }

            final Uri data = intent.getData();

            if (data == null) {

                Slog.e(TAG, "Cannot handle package broadcast with null data");
@@ -338,7 +343,7 @@ public final class OverlayManagerService extends SystemService { 
                userIds = new int[] { UserHandle.getUserId(extraUid) };

            }



            switch (intent.getAction()) {

            switch (action) {

                case ACTION_PACKAGE_ADDED:

                    if (replacing) {

                        onPackageUpgraded(packageName, userIds);