Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2a1e241d authored by Steven Moreland's avatar Steven Moreland
Browse files

libbinder*: ParcelableHolder assert stability read 

The interface a ParcelableHolder is in determines its stability,
and it shouldn't change based on what is sent.

Bug: 215458170
Test: aidl_integration_test
Change-Id: I35f1342edc9f3dc40e2553a4eaf386f67a9fbaa1
parent 2362edf7

libs/binder/ParcelableHolder.cpp

+4 −1
Original line number Diff line number Diff line
@@ -52,7 +52,10 @@ status_t ParcelableHolder::writeToParcel(Parcel* p) const { 
}



status_t ParcelableHolder::readFromParcel(const Parcel* p) {

    this->mStability = static_cast<Stability>(p->readInt32());

    int32_t wireStability;

    if (status_t status = p->readInt32(&wireStability); status != OK) return status;

    if (static_cast<int32_t>(this->mStability) != wireStability) return BAD_VALUE;



    this->mParcelable = nullptr;

    this->mParcelableName = std::nullopt;

    int32_t rawDataSize;

libs/binder/ndk/include_cpp/android/binder_parcelable_utils.h

+6 −1
Original line number Diff line number Diff line
@@ -101,7 +101,12 @@ class AParcelableHolder { 
            return STATUS_INVALID_OPERATION;

        }



        RETURN_ON_FAILURE(AParcel_readInt32(parcel, &this->mStability));

        parcelable_stability_t wireStability;

        RETURN_ON_FAILURE(AParcel_readInt32(parcel, &wireStability));

        if (this->mStability != wireStability) {

            return STATUS_BAD_VALUE;

        }



        int32_t dataSize;

        binder_status_t status = AParcel_readInt32(parcel, &dataSize);

libs/binder/rust/src/parcel/parcelable_holder.rs

+3 −1
Original line number Diff line number Diff line
@@ -233,7 +233,9 @@ impl Parcelable for ParcelableHolder { 
    }



    fn read_from_parcel(&mut self, parcel: &BorrowedParcel<'_>) -> Result<(), StatusCode> {

        self.stability = parcel.read()?;

        if self.stability != parcel.read()? {

            return Err(StatusCode::BAD_VALUE);

        }



        let data_size: i32 = parcel.read()?;

        if data_size < 0 {