Commit 057a01d1 authored by Michael Wachenschwanz's avatar Michael Wachenschwanz Committed by akirilov

Verify number of Map entries written to Parcel

Make sure the number of entries written by Parcel#writeMapInternal
matches the size written. If a mismatch were allowed, an exploitable
scenario could occur where the data read from the Parcel would not
match the data written.

Fixes: 112859604
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest

Change-Id: I325d08a8b66b6e80fe76501359c41b6656848607
Merged-In: I325d08a8b66b6e80fe76501359c41b6656848607
parent bf441335
......@@ -691,11 +691,19 @@ public final class Parcel {
Set<Map.Entry<String,Object>> entries = val.entrySet();
int size = entries.size();
for (Map.Entry<String,Object> e : entries) {
if (size != 0) {
throw new BadParcelableException("Map size does not match number of entries!");
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment