Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6a825e8a authored by Michael Wachenschwanz's avatar Michael Wachenschwanz Committed by Atanas Kirilov
Browse files

Increment when attempting to read protected Parcel Data 

Make sure to increment the parcel data position even when trying to
improperly read from protected data

Bug: 29833520

Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtection
Test (M): cts-tradefed run cts -c android.os.cts.ParcelTest -m testBinderDataProtectionIncrements
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtection
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testBinderDataProtectionIncrements

Change-Id: Ie4aae6277fc5f5c924f603d9828c3a608998b986
Merged-In: Ie4aae6277fc5f5c924f603d9828c3a608998b986
parent f784183c

libs/binder/Parcel.cpp

+17 −3
Original line number Diff line number Diff line
@@ -1125,7 +1125,12 @@ status_t Parcel::read(void* outData, size_t len) const 
            && len <= pad_size(len)) {

        if (mObjectsSize > 0) {

            status_t err = validateReadData(mDataPos + pad_size(len));

            if(err != NO_ERROR) return err;

            if(err != NO_ERROR) {

                // Still increment the data position by the expected length

                mDataPos += pad_size(len);

                ALOGV("read Setting data pos of %p to %zu", this, mDataPos);

                return err;

            }

        }

        memcpy(outData, mData+mDataPos, len);

        mDataPos += pad_size(len);
@@ -1147,7 +1152,12 @@ const void* Parcel::readInplace(size_t len) const 
            && len <= pad_size(len)) {

        if (mObjectsSize > 0) {

            status_t err = validateReadData(mDataPos + pad_size(len));

            if(err != NO_ERROR) return NULL;

            if(err != NO_ERROR) {

                // Still increment the data position by the expected length

                mDataPos += pad_size(len);

                ALOGV("readInplace Setting data pos of %p to %zu", this, mDataPos);

                return NULL;

            }

        }



        const void* data = mData+mDataPos;
@@ -1165,7 +1175,11 @@ status_t Parcel::readAligned(T *pArg) const { 
    if ((mDataPos+sizeof(T)) <= mDataSize) {

        if (mObjectsSize > 0) {

            status_t err = validateReadData(mDataPos + sizeof(T));

            if(err != NO_ERROR) return err;

            if(err != NO_ERROR) {

                // Still increment the data position by the expected length

                mDataPos += sizeof(T);

                return err;

            }

        }



        const void* data = mData+mDataPos;