Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 74d2c4b4 authored by Dianne Hackborn's avatar Dianne Hackborn Committed by android-build-merger
Browse files

Fix issue #27252896: Security Vulnerability -- weak binder

am: 41e7b178

* commit '41e7b178':
  Fix issue #27252896: Security Vulnerability -- weak binder
parents dc5d0f46 41e7b178
Loading
Loading
Loading
Loading
+12 −3
Original line number Diff line number Diff line
@@ -1070,9 +1070,18 @@ status_t IPCThreadState::executeCommand(int32_t cmd)
                    << reinterpret_cast<const size_t*>(tr.data.ptr.offsets) << endl;
            }
            if (tr.target.ptr) {
                sp<BBinder> b((BBinder*)tr.cookie);
                const status_t error = b->transact(tr.code, buffer, &reply, tr.flags);
                // We only have a weak reference on the target object, so we must first try to
                // safely acquire a strong reference before doing anything else with it.
                if (reinterpret_cast<RefBase::weakref_type*>(
                        tr.target.ptr)->attemptIncStrong(this)) {
                    const status_t error = reinterpret_cast<BBinder*>(tr.cookie)->transact(tr.code, buffer,
                            &reply, tr.flags);
                    reinterpret_cast<BBinder*>(tr.cookie)->decStrong(this);
                    if (error < NO_ERROR) reply.setError(error);
                } else {
                    const status_t error = UNKNOWN_TRANSACTION;
                    if (error < NO_ERROR) reply.setError(error);
                }

            } else {
                const status_t error = the_context_object->transact(tr.code, buffer, &reply, tr.flags);