Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit af369f6e authored by David Christie's avatar David Christie Committed by android-build-merger
Browse files

Fix vulnerability where large GPS XTRA data can be injected. -Can potentially... 

Fix vulnerability where large GPS XTRA data can be injected. -Can potentially crash system with OOM. Bug: 29555864 am: dde12c69 am: 3462e526 am: 5a6b1111 am: 655361b2 am: 62783bde
am: 8788a241

Change-Id: If9d5385d7d949e85932e5586d4884ffe84d51d47
parents 975879a1 8788a241

core/java/android/os/Process.java

+15 −6
Original line number Diff line number Diff line
@@ -537,6 +537,15 @@ public class Process { 
            ZygoteState zygoteState, ArrayList<String> args)

            throws ZygoteStartFailedEx {

        try {

            // Throw early if any of the arguments are malformed. This means we can

            // avoid writing a partial response to the zygote.

            int sz = args.size();

            for (int i = 0; i < sz; i++) {

                if (args.get(i).indexOf('\n') >= 0) {

                    throw new ZygoteStartFailedEx("embedded newlines not allowed");

                }

            }



            /**

             * See com.android.internal.os.ZygoteInit.readArgumentList()

             * Presently the wire format to the zygote process is:
@@ -553,13 +562,8 @@ public class Process { 
            writer.write(Integer.toString(args.size()));

            writer.newLine();



            int sz = args.size();

            for (int i = 0; i < sz; i++) {

                String arg = args.get(i);

                if (arg.indexOf('\n') >= 0) {

                    throw new ZygoteStartFailedEx(

                            "embedded newlines not allowed");

                }

                writer.write(arg);

                writer.newLine();

            }
@@ -568,11 +572,16 @@ public class Process { 


            // Should there be a timeout on this?

            ProcessStartResult result = new ProcessStartResult();



            // Always read the entire result from the input stream to avoid leaving

            // bytes in the stream for future process starts to accidentally stumble

            // upon.

            result.pid = inputStream.readInt();

            result.usingWrapper = inputStream.readBoolean();



            if (result.pid < 0) {

                throw new ZygoteStartFailedEx("fork() failed");

            }

            result.usingWrapper = inputStream.readBoolean();

            return result;

        } catch (IOException ex) {

            zygoteState.close();