Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3380a775 authored by Tom O'Neill's avatar Tom O'Neill Committed by android-build-merger
Browse files

Fix exploit where can hide the fact that a location was mocked am: a206a0f1

am: d417e548

Change-Id: I2f47020055f962b36f095137d75c9cbfe6b1a6db
parents 9a158811 d417e548
Loading
Loading
Loading
Loading
+16 −1
Original line number Diff line number Diff line
@@ -57,6 +57,8 @@ import android.os.SystemClock;
import android.os.UserHandle;
import android.os.WorkSource;
import android.provider.Settings;
import android.text.TextUtils;
import android.util.EventLog;
import android.util.Log;
import android.util.Slog;
import com.android.internal.content.PackageMonitor;
@@ -2247,9 +2249,22 @@ public class LocationManagerService extends ILocationManager.Stub {
            if (mockProvider == null) {
                throw new IllegalArgumentException("Provider \"" + provider + "\" unknown");
            }

            // Ensure that the location is marked as being mock. There's some logic to do this in
            // handleLocationChanged(), but it fails if loc has the wrong provider (bug 33091107).
            Location mock = new Location(loc);
            mock.setIsFromMockProvider(true);

            if (!TextUtils.isEmpty(loc.getProvider()) && !provider.equals(loc.getProvider())) {
                // The location has an explicit provider that is different from the mock provider
                // name. The caller may be trying to fool us via bug 33091107.
                EventLog.writeEvent(0x534e4554, "33091107", Binder.getCallingUid(),
                        provider + "!=" + loc.getProvider());
            }

            // clear calling identity so INSTALL_LOCATION_PROVIDER permission is not required
            long identity = Binder.clearCallingIdentity();
            mockProvider.setLocation(loc);
            mockProvider.setLocation(mock);
            Binder.restoreCallingIdentity(identity);
        }
    }