DivestOS/Patches/LineageOS-15.1/android_packages_apps_Bluetooth/345907-backport.patch

42 lines
1.8 KiB
Diff
Raw Normal View History

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Brian Delwiche <delwiche@google.com>
Date: Wed, 28 Sep 2022 23:30:49 +0000
Subject: [PATCH] Fix URI check in BluetoothOppUtility.java
Bug: 225880741
Test: BT unit tests, validated against researcher POC
Tag: #security
Ignore-AOSP-First: Security
Change-Id: I65c1494023930aa23fede55936488f605c7cfe01
(cherry picked from commit d0957cfdf1fc1b36620c1545643ffbc37f0ac24c)
Merged-In: I65c1494023930aa23fede55936488f605c7cfe01
---
src/com/android/bluetooth/opp/BluetoothOppUtility.java | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/com/android/bluetooth/opp/BluetoothOppUtility.java b/src/com/android/bluetooth/opp/BluetoothOppUtility.java
index 0e3df0bf5..f366cca25 100644
--- a/src/com/android/bluetooth/opp/BluetoothOppUtility.java
+++ b/src/com/android/bluetooth/opp/BluetoothOppUtility.java
@@ -47,6 +47,7 @@ import android.content.pm.PackageManager;
import android.content.pm.ResolveInfo;
import android.database.Cursor;
import android.os.Environment;
+import android.util.EventLog;
import android.util.Log;
import java.io.File;
@@ -67,7 +68,11 @@ public class BluetoothOppUtility {
= new ConcurrentHashMap<Uri, BluetoothOppSendFileInfo>();
public static boolean isBluetoothShareUri(Uri uri) {
- return uri.toString().startsWith(BluetoothShare.CONTENT_URI.toString());
+ if (uri.toString().startsWith(BluetoothShare.CONTENT_URI.toString())
+ && !uri.getAuthority().equals(BluetoothShare.CONTENT_URI.getAuthority())) {
+ EventLog.writeEvent(0x534e4554, "225880741", -1, "");
+ }
+ return uri.getAuthority().equals(BluetoothShare.CONTENT_URI.getAuthority());
}
public static BluetoothOppTransferInfo queryRecord(Context context, Uri uri) {