Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f8ef5bcf authored by Michael Wachenschwanz's avatar Michael Wachenschwanz Committed by Bryan Ferris
Browse files

Clear the Parcel before writing an exception during a transaction 

This prevents any object data from being accidentally overwritten by the
exception, which could cause unexpected malformed objects to be sent
across the transaction.

Test: atest CtsOsTestCases:ParcelTest#testExceptionOverwritesObject
Bug: 34175893
Change-Id: Iaf80a0ad711762992b8ae60f76d861c97a403013
Merged-In: Iaf80a0ad711762992b8ae60f76d861c97a403013
parent fe9f143d

core/java/android/os/Binder.java

+2 −0
Original line number Original line Diff line number Diff line
@@ -574,6 +574,8 @@ public class Binder implements IBinder { 
                    Log.w(TAG, "Caught a RuntimeException from the binder stub implementation.", e);

                    Log.w(TAG, "Caught a RuntimeException from the binder stub implementation.", e);

                }

                }

            } else {

            } else {

                // Clear the parcel before writing the exception

                reply.setDataSize(0);

                reply.setDataPosition(0);

                reply.setDataPosition(0);

                reply.writeException(e);

                reply.writeException(e);

            }

            }