Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7250d76a authored by Alex Buynytskyy's avatar Alex Buynytskyy
Browse files

Verify incoming signature. 

Bug: 307288067
Test: atest ChecksumsTest
Change-Id: Iea181bfa387f64ec58f8245b096010c3a1f48adf
parent 02fcb435

services/core/java/com/android/server/pm/ApkChecksums.java

+9 −0
Original line number Diff line number Diff line
@@ -110,6 +110,11 @@ public class ApkChecksums { 


    private static final Certificate[] EMPTY_CERTIFICATE_ARRAY = {};



    /**

     * Arbitrary size restriction for the signature, used to sign the checksums.

     */

    private static final int MAX_SIGNATURE_SIZE_BYTES = 35 * 1024;



    /**

     * Check back in 1 second after we detected we needed to wait for the APK to be fully available.

     */
@@ -260,6 +265,10 @@ public class ApkChecksums { 
     */

    public static @NonNull Certificate[] verifySignature(Checksum[] checksums, byte[] signature)

            throws NoSuchAlgorithmException, IOException, SignatureException {

        if (signature == null || signature.length > MAX_SIGNATURE_SIZE_BYTES) {

            throw new SignatureException("Invalid signature");

        }



        final byte[] blob;

        try (ByteArrayOutputStream os = new ByteArrayOutputStream()) {

            writeChecksums(os, checksums);

services/core/java/com/android/server/pm/PackageInstallerSession.java

+1 −1
Original line number Diff line number Diff line
@@ -1612,7 +1612,7 @@ public class PackageInstallerSession extends IPackageInstallerSession.Stub { 
            try {

                Certificate[] ignored = ApkChecksums.verifySignature(checksums, signature);

            } catch (IOException | NoSuchAlgorithmException | SignatureException e) {

                throw new IllegalArgumentException("Can't verify signature", e);

                throw new IllegalArgumentException("Can't verify signature: " + e.getMessage(), e);

            }

        }