• R/O
  • HTTP
  • SSH
  • HTTPS

提交

標籤
無標籤

Frequently used words (click to add to your profile)

javac++androidlinuxc#windowsobjective-ccocoa誰得qtpythonphprubygameguibathyscaphec計画中(planning stage)翻訳omegatframeworktwitterdomtestvb.netdirectxゲームエンジンbtronarduinopreviewer

system/corennnnn


Commit MetaInfo

修訂2f16eeede62be75301b1b0c786dce94f0bfac5ae (tree)
時間2016-08-20 07:50:00
作者Connor O'Brien <connoro@goog...>
Commiterandroid-build-merger

Log Message

Fix vold vulnerability in FrameworkListener am: 470484d2a2 am: e9e046df6c am: 109024f74a am: b906ad88b9 am: 2fadbb93a4 am: e04054d9bb am: 9745b11db1 am: 2f78b2c3d6 am: 2b5e6d8ffc am: 2427a462c0
am: 6b155c1cc4

Change-Id: Ie6c2bcee1deacb94259a6153097757674fa19251

Change Summary

差異

--- a/include/sysutils/FrameworkListener.h
+++ b/include/sysutils/FrameworkListener.h
@@ -32,6 +32,7 @@ private:
3232 int mCommandCount;
3333 bool mWithSeq;
3434 FrameworkCommandCollection *mCommands;
35+ bool mSkipToNextNullByte;
3536
3637 public:
3738 FrameworkListener(const char *socketName);
--- a/libsysutils/src/FrameworkListener.cpp
+++ b/libsysutils/src/FrameworkListener.cpp
@@ -49,6 +49,7 @@ void FrameworkListener::init(const char *socketName UNUSED, bool withSeq) {
4949 errorRate = 0;
5050 mCommandCount = 0;
5151 mWithSeq = withSeq;
52+ mSkipToNextNullByte = false;
5253 }
5354
5455 bool FrameworkListener::onDataAvailable(SocketClient *c) {
@@ -59,10 +60,15 @@ bool FrameworkListener::onDataAvailable(SocketClient *c) {
5960 if (len < 0) {
6061 SLOGE("read() failed (%s)", strerror(errno));
6162 return false;
62- } else if (!len)
63+ } else if (!len) {
6364 return false;
64- if(buffer[len-1] != '\0')
65+ } else if (buffer[len-1] != '\0') {
6566 SLOGW("String is not zero-terminated");
67+ android_errorWriteLog(0x534e4554, "29831647");
68+ c->sendMsg(500, "Command too large for buffer", false);
69+ mSkipToNextNullByte = true;
70+ return false;
71+ }
6672
6773 int offset = 0;
6874 int i;
@@ -70,11 +76,16 @@ bool FrameworkListener::onDataAvailable(SocketClient *c) {
7076 for (i = 0; i < len; i++) {
7177 if (buffer[i] == '\0') {
7278 /* IMPORTANT: dispatchCommand() expects a zero-terminated string */
73- dispatchCommand(c, buffer + offset);
79+ if (mSkipToNextNullByte) {
80+ mSkipToNextNullByte = false;
81+ } else {
82+ dispatchCommand(c, buffer + offset);
83+ }
7484 offset = i + 1;
7585 }
7686 }
7787
88+ mSkipToNextNullByte = false;
7889 return true;
7990 }
8091