summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Revert "telephony: Initialize USER_NETWORK_MODE with DEFAULT_NW_MODE"staging/cm-14.1-cafrebaseArne Coucheron2017-02-111-2/+2
| | | | | | | This reverts commit f42955e268cec1ea617ec4adc6132149178fa4d5. Change-Id: I92163e9ada92ecc2d9024edfddd9e99fe580f304 (cherry picked from commit 9484d1581074d142e781388c37b24df059538c0d)
* telephony: Initialize USER_NETWORK_MODE with DEFAULT_NW_MODEGabriele M2017-02-111-2/+2
| | | | | | | | | | PREFERRED_NETWORK_MODE is equal to ro.telephony.default_network if set, RILConstants.NETWORK_MODE_WCDMA_PREF otherwise. Therefore its value can be incorrect and should not be used as default user preference. Change-Id: I47f65468e6dcc5dd71f5b4feb4baee7823d764e7 (cherry picked from commit f42955e268cec1ea617ec4adc6132149178fa4d5)
* Automatic translation importinky@build012016-12-3018-0/+475
| | | | | Change-Id: I9b379d42ffe0ec1ec7e9df0423a49870565adce3 Ticket: -
* telephony: Fix initial database creationSteve Kondik2016-12-301-1/+3
| | | | Change-Id: I84619348ebe1ec0259a9d8eddf5a41f8c883582e
* Add DB upgrade path for SMS/MMS and telephony provider.Danny Baumann2016-12-302-73/+318
| | | | Change-Id: I47ed09b0df9ade4bc50cebd8d0ea8cd229a1221d
* TelephonyProvider: Fix Default APN Preference Overlay on 1st BootAaron Knight2016-12-301-5/+18
| | | | | | | | | | | In the current code on CM13, the overlay preference can only be called when Reset APN Settings is called. Looking at the source history this is a regression. Comparing with history, I've restored reading the overlay and tested that the default preference is now marked on the first boot. Change-Id: I3141d486afd45405c57ed25a89d9fa838fadf794
* telephony: Add support for choosing a default APNSteve Kondik2016-12-302-2/+44
| | | | | | | | | | | * Sometimes, the standard method of choosing the "first" available APN is not what we want. Consider the case where a certain provider has both a "normal" APN and an LTE APN. The LTE APN is what we want, but it's not chosen. * Add a new overlayable value "config_preferred_apn" to handle this. A device can override this. The format is "apn,mcc,mnc". Change-Id: Ia6ca4159491bee15b3f18ad7ad524b8b0ffce2f2
* Merge ee5bf7a6e7bffa9edb98f85501fd4b324d9c5b4c on remote branchLinux Build Service Account2016-12-151-1/+0
|\ | | | | | | Change-Id: Ia78db300cd06d5ccb3a88ad724c0246845dbdc68
| * Merge N-MR1 to remote branch.Naveen Kumar2016-12-081-1/+0
| |\ | | | | | | | | | Change-Id: Id223f8f73908ba347f50cd240422f66c9ccb6135
| | * Merge N-MR1 to remoteLalit Kansara2016-12-061-1/+0
| | |\ | | | | | | | | | | | | Change-Id: I1387c83b68cf1895a7381b3e33e48e1743012ed8
| | | * merge in nyc-mr1-release history after reset to nyc-mr1-devgitbuildkicker2016-08-230-0/+0
| | | |\
| | | | * merge in nyc-mr1-release history after reset to nyc-mr1-devgitbuildkicker2016-08-160-0/+0
| | | | |\
| | | | | * merge in nyc-mr1-release history after reset to nyc-mr1-devgitbuildkicker2016-07-210-0/+0
| | | | | |\
| | | | | | * merge in nyc-mr1-release history after reset to nyc-mr1-devThe Android Automerger2016-06-050-0/+0
| | | | | | |\
| | | | | | | * android.intent.action.CONTENT_CHANGED should be system protectedYe Wen2016-05-231-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | b/28795013 Change-Id: Id224b4169b7e0e27dc66f18576e95107a99f3866
| | | * | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: fd9be3377f am: a8ae137579 am: b028c61f44 -s ours am: 7153a8830c -s ours am: 6af147887d am: 2fe0b17cb1 am: fae6fcbf0f -s ours am: f0694fe108 am: 02506d63a6 am: 138308b649 am: dd8ccb5662 -s ours am: 6e30cd12b3 am: 899c10a5a6 Change-Id: I01db64b42d63bc9f11b8b74020a511910b5ff457
| | | | * \ \ \ \ 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: fd9be3377f am: a8ae137579 am: b028c61f44 -s ours am: 7153a8830c -s ours am: 6af147887d am: 2fe0b17cb1 am: fae6fcbf0f -s ours am: f0694fe108 am: 02506d63a6 am: 138308b649 am: dd8ccb5662 -s ours am: 6e30cd12b3 Change-Id: Ibbfdc44fbeb41ee790735bc85c6cfe16ae744a16
| | | | | * \ \ \ \ 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: fd9be3377f am: a8ae137579 am: b028c61f44 -s ours am: 7153a8830c -s ours am: 6af147887d am: 2fe0b17cb1 am: fae6fcbf0f -s ours am: f0694fe108 am: 02506d63a6 am: 138308b649 am: dd8ccb5662 -s ours Change-Id: If99bf13839fdbe4299f5fb406d48547351a9eccb
| | | | | | * \ \ \ \ 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: fd9be3377f am: a8ae137579 am: b028c61f44 -s ours am: 7153a8830c -s ours am: 6af147887d am: 2fe0b17cb1 am: fae6fcbf0f -s ours am: f0694fe108 am: 02506d63a6 am: 138308b649 Change-Id: Iba03d4845e2596bbc2540397ddaa566eaca8b7c4
| | | | | | | * \ \ \ \ 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: fd9be3377f am: a8ae137579 am: b028c61f44 -s ours am: 7153a8830c -s ours am: 6af147887d am: 2fe0b17cb1 am: fae6fcbf0f -s ours am: f0694fe108 am: 02506d63a6 Change-Id: If493cec425928b5c6ee9c8f735cb9899c19cde43
| | | | | | | | * \ \ \ \ 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: fd9be3377f am: a8ae137579 am: b028c61f44 -s ours am: 7153a8830c -s ours am: 6af147887d am: 2fe0b17cb1 am: fae6fcbf0f -s ours am: f0694fe108 Change-Id: I402e817c129530d791e2da71e52977f59198c53c
| | | | | | | | | * \ \ \ \ 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: fd9be3377f am: a8ae137579 am: b028c61f44 -s ours am: 7153a8830c -s ours am: 6af147887d am: 2fe0b17cb1 am: fae6fcbf0f -s ours Change-Id: I286d44e323d782c6b709cca97abe260c91de93b3
| | | | | | | | | | * \ \ \ \ 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | | | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: fd9be3377f am: a8ae137579 am: b028c61f44 -s ours am: 7153a8830c -s ours am: 6af147887d am: 2fe0b17cb1 Change-Id: I1b520c65b3c31f2d9dabd54d87f3da42dd2e1acd
| | | | | | | | | | | * \ \ \ \ 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | | | | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: fd9be3377f am: a8ae137579 am: b028c61f44 -s ours am: 7153a8830c -s ours am: 6af147887d Change-Id: I2381e0136b57168691710ebf43d333c108e72583
| | | | | | | | | | | | * \ \ \ \ 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | | | | | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: fd9be3377f am: a8ae137579 am: b028c61f44 -s ours am: 7153a8830c -s ours Change-Id: I0d8d7cf58297e49273dc05cd2fde9bd45547deb2
| | | | | | | | | | | | | * \ \ \ \ 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | | | | | | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: fd9be3377f am: a8ae137579 am: b028c61f44 -s ours Change-Id: I3c8d4535c9db1a3dc3734ae7ea1e6c4976b3fe16
| | | | | | | | | | | | | | * \ \ \ \ 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-221-6/+31
| | | | | | | | | | | | | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: fd9be3377f am: a8ae137579 Change-Id: I97efa48ee86ca92862b528b0803b0b4c28268e81
| | | | | | | | | | | | | | | * \ \ \ \ 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-221-6/+31
| | | | | | | | | | | | | | | |\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: fd9be3377f Change-Id: I6d000dae9b27336a466dfe49b30fe27084ca6943
| | | | | | | | | | | | | | | | * | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-201-6/+31
| | | | | | | | | | | | | | | |/ / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE Problem: MmsProvider.openFile validated the current _data column in the DB and then called ContentProvider.openFileHelper which was again reading from the DB. A race condition could cause the second DB read to read an updated, malicious value. Fix: instead of doing the first DB check and calling ContentProvider.openFileHelper, we're now just calling MmsProvider.safeOpenFileHelper which does a single check. Test: used the POC provided for this incident. b/30481342 Change-Id: I643ad76bdbbbc68c4b7dbd18f7e76021396d5ed8
| | | * | | | | | | | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 8ce0cad150 -s ours am: c4cded1767 am: ba689bea2f am: e3615f85c6 -s ours am: e7918d5944 am: 7f07953f8f am: 0b4552fe46 am: 20eea1d7f5 -s ours am: 1a6f1e60f5 am: 032813be86 Change-Id: I09f38edc57df341ee273ea67a6a96f7d7aece9d1
| | | | * | | | | | | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 8ce0cad150 -s ours am: c4cded1767 am: ba689bea2f am: e3615f85c6 -s ours am: e7918d5944 am: 7f07953f8f am: 0b4552fe46 am: 20eea1d7f5 -s ours am: 1a6f1e60f5 Change-Id: I150d7f2ec8085673fd36d64deae1fa1e2ac18839
| | | | | * | | | | | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 8ce0cad150 -s ours am: c4cded1767 am: ba689bea2f am: e3615f85c6 -s ours am: e7918d5944 am: 7f07953f8f am: 0b4552fe46 am: 20eea1d7f5 -s ours Change-Id: I6a1b45e07f6252581492056328f738c2973dbfe6
| | | | | | * | | | | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 8ce0cad150 -s ours am: c4cded1767 am: ba689bea2f am: e3615f85c6 -s ours am: e7918d5944 am: 7f07953f8f am: 0b4552fe46 Change-Id: Ib59984fc2beae21cc792680e6b5680b180839e5b
| | | | | | | * | | | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 8ce0cad150 -s ours am: c4cded1767 am: ba689bea2f am: e3615f85c6 -s ours am: e7918d5944 am: 7f07953f8f Change-Id: I375321ae463028e6153414c8e9b724cb05566503
| | | | | | | | * | | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 8ce0cad150 -s ours am: c4cded1767 am: ba689bea2f am: e3615f85c6 -s ours am: e7918d5944 Change-Id: Ic3ae9382444f77e87b074f202d2dbdf16255b588
| | | | | | | | | * | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 8ce0cad150 -s ours am: c4cded1767 am: ba689bea2f am: e3615f85c6 -s ours Change-Id: Ida0e20985c5f674a9fc4c202ed28915cecac4079
| | | | | | | | | | * | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 8ce0cad150 -s ours am: c4cded1767 am: ba689bea2f Change-Id: I1782e64fb54f8b82a0ef09642d2399c4a315564a
| | | | | | | | | | | * | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 8ce0cad150 -s ours am: c4cded1767 Change-Id: I00d2fe876cf3a0eaaf13e75bf2361edffde6c539
| | | | | | | | | | | | * | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 8ce0cad150 -s ours Change-Id: I4dd43e4bbda28ec1ed1dd3bf66a862ce012ce1b4
| | | | | | | | | | | | | * | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-201-6/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE Problem: MmsProvider.openFile validated the current _data column in the DB and then called ContentProvider.openFileHelper which was again reading from the DB. A race condition could cause the second DB read to read an updated, malicious value. Fix: instead of doing the first DB check and calling ContentProvider.openFileHelper, we're now just calling MmsProvider.safeOpenFileHelper which does a single check. Test: used the POC provided for this incident. b/30481342 Change-Id: I643ad76bdbbbc68c4b7dbd18f7e76021396d5ed8
| | | * | | | | | | | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 53ff7691e0 am: 20903846d5 am: 37e2a4dca9 -s ours am: 8c659fb296 am: 916c01a5f9 am: d379a7958f am: f393a8dd36 -s ours am: 412f2f6089 am: fe2d54533c Change-Id: I9329e3a12398fba7e233911ff285ce27b0f14b09
| | | | * | | | | | | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 53ff7691e0 am: 20903846d5 am: 37e2a4dca9 -s ours am: 8c659fb296 am: 916c01a5f9 am: d379a7958f am: f393a8dd36 -s ours am: 412f2f6089 Change-Id: I5eddf8b0e0738436febb5f09cdefea901700e709
| | | | | * | | | | | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 53ff7691e0 am: 20903846d5 am: 37e2a4dca9 -s ours am: 8c659fb296 am: 916c01a5f9 am: d379a7958f am: f393a8dd36 -s ours Change-Id: I6db6ae7e5ea902e8d1277cff40c5143b67d8826f
| | | | | | * | | | | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 53ff7691e0 am: 20903846d5 am: 37e2a4dca9 -s ours am: 8c659fb296 am: 916c01a5f9 am: d379a7958f Change-Id: I03febbce5b332d6d24fdabb95b9b4aa404cb235a
| | | | | | | * | | | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 53ff7691e0 am: 20903846d5 am: 37e2a4dca9 -s ours am: 8c659fb296 am: 916c01a5f9 Change-Id: I67d025ef12eee66f23ed5137a5ef34d8e4875e46
| | | | | | | | * | | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 53ff7691e0 am: 20903846d5 am: 37e2a4dca9 -s ours am: 8c659fb296 Change-Id: Iece1e46af8102faad9dd9f27834b364e1549cb05
| | | | | | | | | * | | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-220-0/+0
| | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 53ff7691e0 am: 20903846d5 am: 37e2a4dca9 -s ours Change-Id: I3a555f3404a7b5ce111dc2802b4326f6ad015910
| | | | | | | | | | * | | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-221-9/+28
| | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 53ff7691e0 am: 20903846d5 Change-Id: I8fa3907f62dcdb63c29f6770dd0ae0772394c008
| | | | | | | | | | | * | | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-221-9/+28
| | | | | | | | | | | |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE am: 53ff7691e0 Change-Id: Ibb6bf700c22e870c4351c7589fede41fe1f8146b
| | | | | | | | | | | | * | | | | | | | 30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to ↵Andre Furtado2016-08-201-9/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | files as phone (radio) uid - DO NOT MERGE Problem: MmsProvider.openFile validated the current _data column in the DB and then called ContentProvider.openFileHelper which was again reading from the DB. A race condition could cause the second DB read to read an updated, malicious value. Fix: instead of doing the first DB check and calling ContentProvider.openFileHelper, we're now just calling MmsProvider.safeOpenFileHelper which does a single check. Test: used the POC provided for this incident. b/30481342 Change-Id: I653129359130b9fae59d4c355320b266c158a698
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-28 06:28:36 +0000