Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a72e7521 authored by Tom O'Neill's avatar Tom O'Neill Committed by android-build-merger
Browse files

Fix exploit where can hide the fact that a location was mocked am: a206a0f1... 

Fix exploit where can hide the fact that a location was mocked am: a206a0f1 am: d417e548 am: 3380a775 am: 0a8978f0 am: 1684e5f3 am: d28eef0c am: 1f458fdc am: d82f8a67 am: 1ac8affd am: 56098f81 am: 7cec76de am: 2da05d0f am: 3b7d90c0 am: f035e8b4
am: 8dc64b72

Change-Id: I1b83d758c57b21c574de55e4de3a80283d9b7f56
parents b4aa5f6e 8dc64b72

services/core/java/com/android/server/LocationManagerService.java

+16 −1
Original line number Diff line number Diff line
@@ -87,6 +87,8 @@ import android.os.UserHandle; 
import android.os.UserManager;

import android.os.WorkSource;

import android.provider.Settings;

import android.text.TextUtils;

import android.util.EventLog;

import android.util.Log;

import android.util.Slog;
@@ -2552,9 +2554,22 @@ public class LocationManagerService extends ILocationManager.Stub { 
            if (mockProvider == null) {

                throw new IllegalArgumentException("Provider \"" + provider + "\" unknown");

            }



            // Ensure that the location is marked as being mock. There's some logic to do this in

            // handleLocationChanged(), but it fails if loc has the wrong provider (bug 33091107).

            Location mock = new Location(loc);

            mock.setIsFromMockProvider(true);



            if (!TextUtils.isEmpty(loc.getProvider()) && !provider.equals(loc.getProvider())) {

                // The location has an explicit provider that is different from the mock provider

                // name. The caller may be trying to fool us via bug 33091107.

                EventLog.writeEvent(0x534e4554, "33091107", Binder.getCallingUid(),

                        provider + "!=" + loc.getProvider());

            }



            // clear calling identity so INSTALL_LOCATION_PROVIDER permission is not required

            long identity = Binder.clearCallingIdentity();

            mockProvider.setLocation(loc);

            mockProvider.setLocation(mock);

            Binder.restoreCallingIdentity(identity);

        }

    }