Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 97c957a0 authored by Devin Moore's avatar Devin Moore Committed by Cherrypicker Worker
Browse files

NotificationHistory validate position value 

We get a position value in a parcel and verify it is smaller than that
parcel's data size before setting it.

Flag: EXEMPT bug fix
Ignore-AOSP-First: security fix
Test: atest NotificationHistoryTest
Bug: 399155883
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:fd4045126ff01cec3d65c053a0c2c01dc231a0f5)
Merged-In: Ica98d82d7d7c1c9c0defcff8d96bf5f36e8f5d36
Change-Id: Ica98d82d7d7c1c9c0defcff8d96bf5f36e8f5d36
parent c5345cbf

core/java/android/app/NotificationHistory.java

+4 −0
Original line number Diff line number Diff line
@@ -256,6 +256,10 @@ public final class NotificationHistory implements Parcelable { 
            mParcel.setDataPosition(0);

            mParcel.appendFrom(data, data.dataPosition(), listByteLength);

            mParcel.setDataSize(mParcel.dataPosition());

            if (positionInParcel > mParcel.dataSize()) {

                throw new IllegalStateException(

                    "Obtained an invalid position value(" + positionInParcel + " from Parcel.");

            }

            mParcel.setDataPosition(positionInParcel);

        }

    }