Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9a2caf2d authored by Austin Borger's avatar Austin Borger
Browse files

Merge "Fix vulnerability in AttributionSource due to incorrect Binder call"... 

Merge "Fix vulnerability in AttributionSource due to incorrect Binder call" into tm-dev am: 4d354407 am: 512c1597

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/26389309



Change-Id: I38385c86b9618c8146bb850cfef3125150706782
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
Merged-In: Ic301a8518b8e57e1c9a2c9f2f845e51dca145257
parents ff8132ea 512c1597

core/java/android/content/AttributionSource.java

+17 −3
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ import android.os.Parcelable; 
import android.os.Process;

import android.permission.PermissionManager;

import android.util.ArraySet;

import android.util.Log;



import com.android.internal.annotations.Immutable;
@@ -87,6 +88,8 @@ import java.util.Set; 
 */

@Immutable

public final class AttributionSource implements Parcelable {

    private static final String TAG = "AttributionSource";



    private static final String DESCRIPTOR = "android.content.AttributionSource";



    private static final Binder sDefaultToken = new Binder(DESCRIPTOR);
@@ -154,10 +157,21 @@ public final class AttributionSource implements Parcelable { 
    AttributionSource(@NonNull Parcel in) {

        this(AttributionSourceState.CREATOR.createFromParcel(in));



        if (!Binder.isDirectlyHandlingTransaction()) {

            Log.e(TAG, "Unable to verify calling UID #" + mAttributionSourceState.uid + " PID #"

                    + mAttributionSourceState.pid + " when not handling Binder transaction; "

                    + "clearing.");

            mAttributionSourceState.pid = -1;

            mAttributionSourceState.uid = -1;

            mAttributionSourceState.packageName = null;

            mAttributionSourceState.attributionTag = null;

            mAttributionSourceState.next = null;

        } else {

            // Since we just unpacked this object as part of it transiting a Binder

            // call, this is the perfect time to enforce that its UID and PID can be trusted

            enforceCallingUidAndPid();

        }

    }



    /** @hide */

    public AttributionSource(@NonNull AttributionSourceState attributionSourceState) {