adb: Check sender's socket id when receiving packets.
handle_packet() in adb.c didn't check that when an A_WRTE packet is received, the sender's local-id matches the socket's peer id. This meant that a compromised adbd server could sent packets to the host adb server, spoofing the identity of another connected device if it could "guess" the right host socket id. This patch gets rid of the issue by enforcing even more checks to ensure that all packets comply with the description in protocol.txt. + Fix a bug where closing a local socket associated with a remote one would always send an A_CLSE(0, remote-id, "") message, though protocol.txt says that should only happen for failed opens. The issue was that local_socket_close() called remote_socket_close() after clearing the remote socket's 'peer' field. The fix introduces a new asocket optional callback, named 'shutdown' that is called before that, and is used to send the A_CLSE() message with the right ID in remote_socket_shutdown(). Also add some code in handle_packet() to detect invalid close commands. Change-Id: I9098bc8c6e81f8809334b060e5dca4fc92e6fbc9
Loading
Please register or sign in to comment