Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d417e548 authored by Tom O'Neill's avatar Tom O'Neill Committed by android-build-merger
Browse files

Fix exploit where can hide the fact that a location was mocked

am: a206a0f1

Change-Id: Ib3af056919a4b909d3d11dd3fe2b46eaa7cdf0f4
parents a5affb04 a206a0f1
Loading
Loading
Loading
Loading
+16 −1
Original line number Diff line number Diff line
@@ -57,6 +57,8 @@ import android.os.SystemClock;
import android.os.UserHandle;
import android.os.WorkSource;
import android.provider.Settings;
import android.text.TextUtils;
import android.util.EventLog;
import android.util.Log;
import android.util.Slog;
import com.android.internal.content.PackageMonitor;
@@ -2247,9 +2249,22 @@ public class LocationManagerService extends ILocationManager.Stub {
            if (mockProvider == null) {
                throw new IllegalArgumentException("Provider \"" + provider + "\" unknown");
            }

            // Ensure that the location is marked as being mock. There's some logic to do this in
            // handleLocationChanged(), but it fails if loc has the wrong provider (bug 33091107).
            Location mock = new Location(loc);
            mock.setIsFromMockProvider(true);

            if (!TextUtils.isEmpty(loc.getProvider()) && !provider.equals(loc.getProvider())) {
                // The location has an explicit provider that is different from the mock provider
                // name. The caller may be trying to fool us via bug 33091107.
                EventLog.writeEvent(0x534e4554, "33091107", Binder.getCallingUid(),
                        provider + "!=" + loc.getProvider());
            }

            // clear calling identity so INSTALL_LOCATION_PROVIDER permission is not required
            long identity = Binder.clearCallingIdentity();
            mockProvider.setLocation(loc);
            mockProvider.setLocation(mock);
            Binder.restoreCallingIdentity(identity);
        }
    }