Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d1df8f4d authored by Jeongsik Mun's avatar Jeongsik Mun Committed by Todd Kennedy
Browse files

Fix a bug in RuleIndexingController where StackOverflowError occurs 

A map with a single entry passed into searchKeysRangeContainingKey()
will lead to StackOverflowError due to infinite recursion. There is
a possibility that it could happen if the indexing file is corrupted
and has a few bytes.

This fix adds a termination condition of recursion to break out
and a check to make sure the indexing file is not corrupted.

Test: atest FrameworksServicesTests:RuleIndexingControllerTest
Bug: 178185562

Change-Id: Ic79584d7fabd56ae298d452060ce8d588bc02d21
parent 8dc4ecd2

services/core/java/com/android/server/integrity/parser/RuleIndexingController.java

+6 −0
Original line number Diff line number Diff line
@@ -92,6 +92,9 @@ public class RuleIndexingController { 
                break;

            }

        }

        if (keyToIndexMap.size() < 2) {

            throw new IllegalStateException("Indexing file is corrupt.");

        }

        return keyToIndexMap;

    }
@@ -106,6 +109,9 @@ public class RuleIndexingController { 


    private static List<String> searchKeysRangeContainingKey(

            List<String> sortedKeyList, String key, int startIndex, int endIndex) {

        if (endIndex <= startIndex) {

            throw new IllegalStateException("Indexing file is corrupt.");

        }

        if (endIndex - startIndex == 1) {

            return Arrays.asList(sortedKeyList.get(startIndex), sortedKeyList.get(endIndex));

        }

services/tests/servicestests/src/com/android/server/integrity/parser/RuleIndexingControllerTest.java

+18 −0
Original line number Diff line number Diff line
@@ -25,6 +25,8 @@ import static com.android.server.integrity.utils.TestUtils.getValueBits; 


import static com.google.common.truth.Truth.assertThat;



import static org.testng.Assert.assertThrows;



import android.content.integrity.AppInstallMetadata;



import org.junit.Test;
@@ -163,6 +165,22 @@ public class RuleIndexingControllerTest { 
                        new RuleIndexRange(900, 945));

    }



    @Test

    public void verifyIndexingFileIsCorrupt() throws IOException {

        byte[] stringBytes =

                getBytes(

                        getKeyValueString(START_INDEXING_KEY, 100)

                                + getKeyValueString("ccc", 200)

                                + getKeyValueString(END_INDEXING_KEY, 300)

                                + getKeyValueString(END_INDEXING_KEY, 900));

        ByteBuffer rule = ByteBuffer.allocate(stringBytes.length);

        rule.put(stringBytes);

        InputStream inputStream = new ByteArrayInputStream(rule.array());



        assertThrows(IllegalStateException.class,

                () -> new RuleIndexingController(inputStream));

    }



    private static InputStream obtainDefaultIndexingMapForTest() {

        byte[] stringBytes =

                getBytes(