Commit 117ca495 authored by Michael Wachenschwanz's avatar Michael Wachenschwanz Committed by android-build-team Robot

Verify number of Map entries written to Parcel

Make sure the number of entries written by Parcel#writeMapInternal
matches the size written. If a mismatch were allowed, an exploitable
scenario could occur where the data read from the Parcel would not
match the data written.

Fixes: 112859604
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest

Change-Id: I325d08a8b66b6e80fe76501359c41b6656848607
Merged-In: I325d08a8b66b6e80fe76501359c41b6656848607
(cherry picked from commit 057a01d1)
parent 552371d1
......@@ -806,11 +806,19 @@ public final class Parcel {
return;
}
Set<Map.Entry<String,Object>> entries = val.entrySet();
writeInt(entries.size());
int size = entries.size();
writeInt(size);
for (Map.Entry<String,Object> e : entries) {
writeValue(e.getKey());
writeValue(e.getValue());
size--;
}
if (size != 0) {
throw new BadParcelableException("Map size does not match number of entries!");
}
}
/**
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment