summaryrefslogtreecommitdiffstats
path: root/libsysutils
diff options
context:
space:
mode:
authorConnor O'Brien <connoro@google.com>2016-08-19 22:11:27 +0000
committerandroid-build-merger <android-build-merger@google.com>2016-08-19 22:11:27 +0000
commitb906ad88b9dbd17f947cce963626abfbc4da950f (patch)
treeec3f73eddf97f6fa9f6ee2f1339bc7558f2ae531 /libsysutils
parent58dd6f7cba7d439bbc5eb527e4badd2a05baa89a (diff)
parent109024f74a4cb12dfb4b2e34fd1e913aae1e0d3e (diff)
downloadsystem_core-b906ad88b9dbd17f947cce963626abfbc4da950f.tar.gz
system_core-b906ad88b9dbd17f947cce963626abfbc4da950f.tar.bz2
system_core-b906ad88b9dbd17f947cce963626abfbc4da950f.zip
Fix vold vulnerability in FrameworkListener am: 470484d2a2 am: e9e046df6c
am: 109024f74a Change-Id: Ia6e8dca36bc28d442a6e374ecf033b79176f4b93
Diffstat (limited to 'libsysutils')
-rw-r--r--libsysutils/src/FrameworkListener.cpp17
1 files changed, 14 insertions, 3 deletions
diff --git a/libsysutils/src/FrameworkListener.cpp b/libsysutils/src/FrameworkListener.cpp
index e7b3dd69a..579ead991 100644
--- a/libsysutils/src/FrameworkListener.cpp
+++ b/libsysutils/src/FrameworkListener.cpp
@@ -49,6 +49,7 @@ void FrameworkListener::init(const char *socketName UNUSED, bool withSeq) {
errorRate = 0;
mCommandCount = 0;
mWithSeq = withSeq;
+ mSkipToNextNullByte = false;
}
bool FrameworkListener::onDataAvailable(SocketClient *c) {
@@ -59,10 +60,15 @@ bool FrameworkListener::onDataAvailable(SocketClient *c) {
if (len < 0) {
SLOGE("read() failed (%s)", strerror(errno));
return false;
- } else if (!len)
+ } else if (!len) {
return false;
- if(buffer[len-1] != '\0')
+ } else if (buffer[len-1] != '\0') {
SLOGW("String is not zero-terminated");
+ android_errorWriteLog(0x534e4554, "29831647");
+ c->sendMsg(500, "Command too large for buffer", false);
+ mSkipToNextNullByte = true;
+ return false;
+ }
int offset = 0;
int i;
@@ -70,11 +76,16 @@ bool FrameworkListener::onDataAvailable(SocketClient *c) {
for (i = 0; i < len; i++) {
if (buffer[i] == '\0') {
/* IMPORTANT: dispatchCommand() expects a zero-terminated string */
- dispatchCommand(c, buffer + offset);
+ if (mSkipToNextNullByte) {
+ mSkipToNextNullByte = false;
+ } else {
+ dispatchCommand(c, buffer + offset);
+ }
offset = i + 1;
}
}
+ mSkipToNextNullByte = false;
return true;
}