Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fd404512 authored by Devin Moore's avatar Devin Moore
Browse files

NotificationHistory validate position value 

We get a position value in a parcel and verify it is smaller than that
parcel's data size before setting it.

Flag: EXEMPT bug fix
Ignore-AOSP-First: security fix
Test: atest NotificationHistoryTest
Bug: 399155883
Change-Id: Ica98d82d7d7c1c9c0defcff8d96bf5f36e8f5d36
parent b33fcffc

core/java/android/app/NotificationHistory.java

+4 −0
Original line number Original line Diff line number Diff line
@@ -256,6 +256,10 @@ public final class NotificationHistory implements Parcelable { 
            mParcel.setDataPosition(0);

            mParcel.setDataPosition(0);

            mParcel.appendFrom(data, data.dataPosition(), listByteLength);

            mParcel.appendFrom(data, data.dataPosition(), listByteLength);

            mParcel.setDataSize(mParcel.dataPosition());

            mParcel.setDataSize(mParcel.dataPosition());

            if (positionInParcel > mParcel.dataSize()) {

                throw new IllegalStateException(

                    "Obtained an invalid position value(" + positionInParcel + " from Parcel.");

            }

            mParcel.setDataPosition(positionInParcel);

            mParcel.setDataPosition(positionInParcel);

        }

        }

    }

    }