Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e564a36b authored by Dianne Hackborn's avatar Dianne Hackborn Committed by android-build-merger
Browse files

Fix issue #27252896: Security Vulnerability -- weak binder am: 12bafe20 

am: b4f0f339

* commit 'b4f0f339':
  Fix issue #27252896: Security Vulnerability -- weak binder
parents fdd9851b b4f0f339

libs/binder/IPCThreadState.cpp

+10 −2
Original line number Diff line number Diff line
@@ -1062,8 +1062,16 @@ status_t IPCThreadState::executeCommand(int32_t cmd) 
                    << reinterpret_cast<const size_t*>(tr.data.ptr.offsets) << endl;

            }

            if (tr.target.ptr) {

                sp<BBinder> b((BBinder*)tr.cookie);

                error = b->transact(tr.code, buffer, &reply, tr.flags);

                // We only have a weak reference on the target object, so we must first try to

                // safely acquire a strong reference before doing anything else with it.

                if (reinterpret_cast<RefBase::weakref_type*>(

                        tr.target.ptr)->attemptIncStrong(this)) {

                    error = reinterpret_cast<BBinder*>(tr.cookie)->transact(tr.code, buffer,

                            &reply, tr.flags);

                    reinterpret_cast<BBinder*>(tr.cookie)->decStrong(this);

                } else {

                    error = UNKNOWN_TRANSACTION;

                }



            } else {

                error = the_context_object->transact(tr.code, buffer, &reply, tr.flags);