Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6a947f04 authored by Michael Wachenschwanz's avatar Michael Wachenschwanz Committed by android-build-team Robot
Browse files

Verify number of Map entries written to Parcel 

Make sure the number of entries written by Parcel#writeMapInternal
matches the size written. If a mismatch were allowed, an exploitable
scenario could occur where the data read from the Parcel would not
match the data written.

Fixes: 112859604
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest

Change-Id: I325d08a8b66b6e80fe76501359c41b6656848607
Merged-In: I325d08a8b66b6e80fe76501359c41b6656848607
(cherry picked from commit 057a01d1)
parent 8e81142a

core/java/android/os/Parcel.java

+9 −1
Original line number Diff line number Diff line
@@ -835,11 +835,19 @@ public final class Parcel { 
            return;

        }

        Set<Map.Entry<String,Object>> entries = val.entrySet();

        writeInt(entries.size());

        int size = entries.size();

        writeInt(size);



        for (Map.Entry<String,Object> e : entries) {

            writeValue(e.getKey());

            writeValue(e.getValue());

            size--;

        }



        if (size != 0) {

            throw new BadParcelableException("Map size does not match number of entries!");

        }



    }



    /**