Fix vulnerability in LockSettings service (2d71384a) · Commits · e / os / android_frameworks_base

core/java/com/android/internal/widget/LockPatternUtils.java

+2 −2

Original line number	Diff line number	Diff line
		@@ -287,7 +287,7 @@ public class LockPatternUtils {
		return false;
		}
		} catch (RemoteException re) {
		return true;
		return false;
		}
		}

		@@ -336,7 +336,7 @@ public class LockPatternUtils {
		return false;
		}
		} catch (RemoteException re) {
		return true;
		return false;
		}
		}

+6 −0

Original line number	Diff line number	Diff line
		@@ -512,6 +512,9 @@ public class LockSettingsService extends ILockSettings.Stub {
		private VerifyCredentialResponse doVerifyPattern(String pattern, boolean hasChallenge,
		long challenge, int userId) throws RemoteException {
		checkPasswordReadPermission(userId);
		if (TextUtils.isEmpty(pattern)) {
		throw new IllegalArgumentException("Pattern can't be null or empty");
		}
		CredentialHash storedHash = mStorage.readPatternHash(userId);
		boolean shouldReEnrollBaseZero = storedHash != null && storedHash.isBaseZeroPattern;

		@@ -568,6 +571,9 @@ public class LockSettingsService extends ILockSettings.Stub {
		private VerifyCredentialResponse doVerifyPassword(String password, boolean hasChallenge,
		long challenge, int userId) throws RemoteException {
		checkPasswordReadPermission(userId);
		if (TextUtils.isEmpty(password)) {
		throw new IllegalArgumentException("Password can't be null or empty");
		}
		CredentialHash storedHash = mStorage.readPasswordHash(userId);
		return verifyCredential(userId, storedHash, password, hasChallenge, challenge,
		new CredentialUtil() {