14.1: October ASB picks

Signed-off-by: Tad <tad@spotco.us>

Patches/LineageOS-14.1/android_external_libxml2/367634.patch

@@ -0,0 +1,123 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Fri, 17 Feb 2023 15:53:07 +0100
+Subject: [PATCH] malloc-fail: Fix OOB read after xmlRegGetCounter
+
+Found with libFuzzer, see #344.
+
+(cherry picked from commit 1743c4c3fc58cf38ecce68db9de51d0f3651e033)
+
+I also copied the error label from
+e64653c0e7975594e27d7de2ed4be062c1e4ad03 to fix the build failure.
+
+Bug: http://b/274231102
+Test: TreeHugger
+(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:381160fc2a293d50a627c9e35bb34485bf97b6e7)
+Merged-In: I3bad3e03092e17a761cb6e299aff848ebd35b6f4
+Change-Id: I3bad3e03092e17a761cb6e299aff848ebd35b6f4
+---
+ xmlregexp.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/xmlregexp.c b/xmlregexp.c
+index d255fbf0..6234a879 100644
+--- a/xmlregexp.c
++++ b/xmlregexp.c
+@@ -1641,6 +1641,8 @@ xmlFAGenerateTransitions(xmlRegParserCtxtPtr ctxt, xmlRegStatePtr from,
+ 			return(-1);
+ 		    inter = ctxt->state;
+ 		    counter = xmlRegGetCounter(ctxt);
++                    if (counter < 0)
++                        return(-1);
+ 		    ctxt->counters[counter].min = atom->min - 1;
+ 		    ctxt->counters[counter].max = atom->max - 1;
+ 		    /* count the number of times we see it again */
+@@ -1659,6 +1661,8 @@ xmlFAGenerateTransitions(xmlRegParserCtxtPtr ctxt, xmlRegStatePtr from,
+ 		     * epsilon transition.
+ 		     */
+ 		    counter = xmlRegGetCounter(ctxt);
++                    if (counter < 0)
++                        return(-1);
+ 		    ctxt->counters[counter].min = atom->min - 1;
+ 		    ctxt->counters[counter].max = atom->max - 1;
+ 		    /* count the number of times we see it again */
+@@ -5924,6 +5928,8 @@ xmlAutomataNewCountTrans2(xmlAutomataPtr am, xmlAutomataStatePtr from,
+      * associate a counter to the transition.
+      */
+     counter = xmlRegGetCounter(am);
++    if (counter < 0)
++        goto error;
+     am->counters[counter].min = min;
+     am->counters[counter].max = max;
+ 
+@@ -5943,6 +5949,10 @@ xmlAutomataNewCountTrans2(xmlAutomataPtr am, xmlAutomataStatePtr from,
+     if (min == 0)
+ 	xmlFAGenerateEpsilonTransition(am, from, to);
+     return(to);
++
++error:
++    xmlRegFreeAtom(atom);
++    return(NULL);
+ }
+ 
+ /**
+@@ -5990,6 +6000,8 @@ xmlAutomataNewCountTrans(xmlAutomataPtr am, xmlAutomataStatePtr from,
+      * associate a counter to the transition.
+      */
+     counter = xmlRegGetCounter(am);
++    if (counter < 0)
++        goto error;
+     am->counters[counter].min = min;
+     am->counters[counter].max = max;
+ 
+@@ -6009,6 +6021,10 @@ xmlAutomataNewCountTrans(xmlAutomataPtr am, xmlAutomataStatePtr from,
+     if (min == 0)
+ 	xmlFAGenerateEpsilonTransition(am, from, to);
+     return(to);
++
++error:
++    xmlRegFreeAtom(atom);
++    return(NULL);
+ }
+ 
+ /**
+@@ -6076,6 +6092,8 @@ xmlAutomataNewOnceTrans2(xmlAutomataPtr am, xmlAutomataStatePtr from,
+      * associate a counter to the transition.
+      */
+     counter = xmlRegGetCounter(am);
++    if (counter < 0)
++        goto error;
+     am->counters[counter].min = 1;
+     am->counters[counter].max = 1;
+ 
+@@ -6088,6 +6106,10 @@ xmlAutomataNewOnceTrans2(xmlAutomataPtr am, xmlAutomataStatePtr from,
+     xmlRegAtomPush(am, atom);
+     am->state = to;
+     return(to);
++
++error:
++    xmlRegFreeAtom(atom);
++    return(NULL);
+ }
+ 
+ 
+@@ -6135,6 +6157,8 @@ xmlAutomataNewOnceTrans(xmlAutomataPtr am, xmlAutomataStatePtr from,
+      * associate a counter to the transition.
+      */
+     counter = xmlRegGetCounter(am);
++    if (counter < 0)
++        goto error;
+     am->counters[counter].min = 1;
+     am->counters[counter].max = 1;
+ 
+@@ -6147,6 +6171,10 @@ xmlAutomataNewOnceTrans(xmlAutomataPtr am, xmlAutomataStatePtr from,
+     xmlRegAtomPush(am, atom);
+     am->state = to;
+     return(to);
++
++error:
++    xmlRegFreeAtom(atom);
++    return(NULL);
+ }
+ 
+ /**

Patches/LineageOS-14.1/android_frameworks_base/367635.patch

@@ -0,0 +1,60 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jean-Michel Trivi <jmtrivi@google.com>
+Date: Wed, 7 Dec 2022 04:36:46 +0000
+Subject: [PATCH] RingtoneManager: verify default ringtone is audio
+
+When a ringtone picker tries to set a ringtone through
+RingtoneManager.setActualDefaultRingtoneUri (also
+called by com.android.settings.DefaultRingtonePreference),
+verify the mimeType can be obtained (not found when caller
+doesn't have access to it) and it is an audio resource.
+
+Bug: 205837340
+Test: atest android.media.audio.cts.RingtoneManagerTest
+(cherry picked from commit 38618f9fb16d3b5617e2289354d47abe5af17dad)
+(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:377144b64325dadad102f5233ecb50a4446b205b)
+Merged-In: I3f2c487ded405c0c1a83ef0a2fe99cff7cc9328e
+Change-Id: I3f2c487ded405c0c1a83ef0a2fe99cff7cc9328e
+---
+ media/java/android/media/RingtoneManager.java | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/media/java/android/media/RingtoneManager.java b/media/java/android/media/RingtoneManager.java
+index 86ebae111029..60ee6cd1fc6b 100644
+--- a/media/java/android/media/RingtoneManager.java
++++ b/media/java/android/media/RingtoneManager.java
+@@ -647,10 +647,10 @@ public class RingtoneManager {
+                 setting, context.getUserId());
+         return uriString != null ? Uri.parse(uriString) : null;
+     }
+-    
++
+     /**
+      * Sets the {@link Uri} of the default sound for a given sound type.
+-     * 
++     *
+      * @param context A context used for querying.
+      * @param type The type whose default sound should be set. One of
+      *            {@link #TYPE_RINGTONE}, {@link #TYPE_NOTIFICATION}, or
+@@ -663,6 +663,21 @@ public class RingtoneManager {
+ 
+         String setting = getSettingForType(type);
+         if (setting == null) return;
++
++        if (ringtoneUri != null) {
++            final String mimeType = resolver.getType(ringtoneUri);
++            if (mimeType == null) {
++                Log.e(TAG, "setActualDefaultRingtoneUri for URI:" + ringtoneUri
++                        + " ignored: failure to find mimeType (no access from this context?)");
++                return;
++            }
++            if (!(mimeType.startsWith("audio/") || mimeType.equals("application/ogg"))) {
++                Log.e(TAG, "setActualDefaultRingtoneUri for URI:" + ringtoneUri
++                        + " ignored: associated mimeType:" + mimeType + " is not an audio type");
++                return;
++            }
++        }
++
+         Settings.System.putStringForUser(resolver, setting,
+                 ringtoneUri != null ? ringtoneUri.toString() : null, context.getUserId());
+ 

Patches/LineageOS-14.1/android_frameworks_base/367636.patch

@@ -0,0 +1,59 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Kunal Malhotra <malhk@google.com>
+Date: Fri, 2 Jun 2023 23:32:02 +0000
+Subject: [PATCH] Fixing DatabaseUtils to detect malformed UTF-16 strings
+
+Test: tested with POC in bug, also using atest
+Bug: 224771621
+(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:fb4a72e3943d166088407e61aa4439ac349f3f12)
+Merged-In: Ide65205b83063801971c5778af3154bcf3f0e530
+Change-Id: Ide65205b83063801971c5778af3154bcf3f0e530
+---
+ core/java/android/database/DatabaseUtils.java | 32 +++++++++++++------
+ 1 file changed, 23 insertions(+), 9 deletions(-)
+
+diff --git a/core/java/android/database/DatabaseUtils.java b/core/java/android/database/DatabaseUtils.java
+index 227066ddc571..b27d32457aba 100644
+--- a/core/java/android/database/DatabaseUtils.java
++++ b/core/java/android/database/DatabaseUtils.java
+@@ -337,17 +337,31 @@ public class DatabaseUtils {
+      */
+     public static void appendEscapedSQLString(StringBuilder sb, String sqlString) {
+         sb.append('\'');
+-        if (sqlString.indexOf('\'') != -1) {
+-            int length = sqlString.length();
+-            for (int i = 0; i < length; i++) {
+-                char c = sqlString.charAt(i);
+-                if (c == '\'') {
+-                    sb.append('\'');
++        int length = sqlString.length();
++        for (int i = 0; i < length; i++) {
++            char c = sqlString.charAt(i);
++            if (Character.isHighSurrogate(c)) {
++                if (i == length - 1) {
++                    continue;
++                }
++                if (Character.isLowSurrogate(sqlString.charAt(i + 1))) {
++                    // add them both
++                    sb.append(c);
++                    sb.append(sqlString.charAt(i + 1));
++                    continue;
++                } else {
++                    // this is a lone surrogate, skip it
++                    continue;
+                 }
+-                sb.append(c);
+             }
+-        } else
+-            sb.append(sqlString);
++            if (Character.isLowSurrogate(c)) {
++                continue;
++            }
++            if (c == '\'') {
++                sb.append('\'');
++            }
++            sb.append(c);
++        }
+         sb.append('\'');
+     }
+ 

Patches/LineageOS-14.1/android_frameworks_base/367637.patch

@@ -0,0 +1,52 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Josep del Rio <joseprio@google.com>
+Date: Mon, 26 Jun 2023 11:16:37 +0000
+Subject: [PATCH] Do not share key mappings with JNI object
+
+The key mapping information between the native key mappings and
+the KeyCharacterMap object available in Java is currently shared,
+which means that a read can be attempted while it's being modified.
+
+Because the code changed between R and S, this CL fixes it just
+for R; the patch for versions S+ is ag/23785419
+
+Bug: 274058082
+Test: Presubmit
+(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:4b3c4620166071561ec44961fb08a56676b4fd6c)
+Merged-In: I3be94534dcda365da473f82347ae2e3f57bb1b42
+Change-Id: I3be94534dcda365da473f82347ae2e3f57bb1b42
+---
+ core/jni/android_view_InputDevice.cpp | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/core/jni/android_view_InputDevice.cpp b/core/jni/android_view_InputDevice.cpp
+index 9cf6a9d08890..8c9cd8b4146a 100644
+--- a/core/jni/android_view_InputDevice.cpp
++++ b/core/jni/android_view_InputDevice.cpp
+@@ -14,6 +14,7 @@
+  * limitations under the License.
+  */
+ 
++#include <binder/Parcel.h>
+ #include <input/Input.h>
+ 
+ #include <android_runtime/AndroidRuntime.h>
+@@ -48,9 +49,16 @@ jobject android_view_InputDevice_create(JNIEnv* env, const InputDeviceInfo& devi
+         return NULL;
+     }
+ 
++    sp<KeyCharacterMap> map = deviceInfo.getKeyCharacterMap();
++    if (map != nullptr) {
++        Parcel parcel;
++        map->writeToParcel(&parcel);
++        map = map->readFromParcel(&parcel);
++    }
++
+     ScopedLocalRef<jobject> kcmObj(env,
+-            android_view_KeyCharacterMap_create(env, deviceInfo.getId(),
+-            deviceInfo.getKeyCharacterMap()));
++                                   android_view_KeyCharacterMap_create(env, deviceInfo.getId(),
++                                                                       map));
+     if (!kcmObj.get()) {
+         return NULL;
+     }

Patches/LineageOS-14.1/android_frameworks_base/367638.patch

@@ -0,0 +1,29 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Josep del Rio <joseprio@google.com>
+Date: Wed, 12 Jul 2023 16:32:05 +0000
+Subject: [PATCH] Fix KCM key mapping cloning
+
+ag/23792288 tried to fix a security issue by cloning the key
+mappings, but unfortunately the parcel was not being rewinded.
+
+Bug: 274058082
+Test: Confirmed change works in newer Android versions
+(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:aaaba6cf190d976efdc5db6c78997dbdc9214c15)
+Merged-In: I6f75b9202e20d82ebf81a35a2916e653ee1b8372
+Change-Id: I6f75b9202e20d82ebf81a35a2916e653ee1b8372
+---
+ core/jni/android_view_InputDevice.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/core/jni/android_view_InputDevice.cpp b/core/jni/android_view_InputDevice.cpp
+index 8c9cd8b4146a..4275c40a643f 100644
+--- a/core/jni/android_view_InputDevice.cpp
++++ b/core/jni/android_view_InputDevice.cpp
+@@ -53,6 +53,7 @@ jobject android_view_InputDevice_create(JNIEnv* env, const InputDeviceInfo& devi
+     if (map != nullptr) {
+         Parcel parcel;
+         map->writeToParcel(&parcel);
++        parcel.setDataPosition(0);
+         map = map->readFromParcel(&parcel);
+     }
+ 

Patches/LineageOS-14.1/android_packages_apps_Settings/367639.patch

@@ -0,0 +1,66 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Weng Su <wengsu@google.com>
+Date: Fri, 7 Jul 2023 19:52:04 +0800
+Subject: [PATCH] Restrict ApnEditor settings
+
+- Finish ApnEditor settings if user is not an admin
+
+- Finish ApnEditor settings if user has DISALLOW_CONFIG_MOBILE_NETWORKS restriction
+
+Bug: 279902472
+Test: manual test
+make RunSettingsRoboTests ROBOTEST_FILTER=ApnEditorTest
+(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:5c2d727b8f9198bf758a4896eda7c9e5385435ff)
+Merged-In: Iecdbbff7e21dfb11e3ba385858747a220cfd3e04
+Change-Id: Iecdbbff7e21dfb11e3ba385858747a220cfd3e04
+---
+ src/com/android/settings/ApnEditor.java | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/src/com/android/settings/ApnEditor.java b/src/com/android/settings/ApnEditor.java
+index 96c3cda1e3..81e39359d5 100755
+--- a/src/com/android/settings/ApnEditor.java
++++ b/src/com/android/settings/ApnEditor.java
+@@ -31,6 +31,7 @@ import android.database.Cursor;
+ import android.net.Uri;
+ import android.os.Bundle;
+ import android.os.PersistableBundle;
++import android.os.UserManager;
+ import android.provider.Telephony;
+ import android.support.v14.preference.MultiSelectListPreference;
+ import android.support.v14.preference.SwitchPreference;
+@@ -178,6 +179,11 @@ public class ApnEditor extends SettingsPreferenceFragment
+     @Override
+     public void onCreate(Bundle icicle) {
+         super.onCreate(icicle);
++        if (isUserRestricted()) {
++            Log.e(TAG, "This setting isn't available due to user restriction.");
++            finish();
++            return;
++        }
+ 
+         addPreferencesFromResource(R.xml.apn_editor);
+ 
+@@ -979,6 +985,22 @@ public class ApnEditor extends SettingsPreferenceFragment
+         }
+     }
+ 
++    boolean isUserRestricted() {
++        UserManager userManager = getContext().getSystemService(UserManager.class);
++        if (userManager == null) {
++            return false;
++        }
++        if (!userManager.isAdminUser()) {
++            Log.e(TAG, "User is not an admin");
++            return true;
++        }
++        if (userManager.hasUserRestriction(UserManager.DISALLOW_CONFIG_MOBILE_NETWORKS)) {
++            Log.e(TAG, "User is not allowed to configure mobile network");
++            return true;
++        }
++        return false;
++    }
++
+     public static class ErrorDialog extends DialogFragment {
+ 
+         public static void showError(ApnEditor editor) {

Scripts/LineageOS-14.1/Patch.sh

@@ -76,7 +76,7 @@ sed -i '50i$(my_res_package): PRIVATE_AAPT_FLAGS += --auto-add-overlay' core/aap
 sed -i '296iLOCAL_AAPT_FLAGS += --auto-add-overlay' core/package_internal.mk;
 awk -i inplace '!/Email/' target/product/core.mk; #Remove Email
 awk -i inplace '!/Exchange2/' target/product/core.mk;
-sed -i 's/2021-06-05/2023-09-05/' core/version_defaults.mk; #Bump Security String #n-asb-2023-09 #XXX
+sed -i 's/2021-06-05/2023-10-05/' core/version_defaults.mk; #Bump Security String #n-asb-2023-10 #XXX
 fi;
 
 if enterAndClear "device/qcom/sepolicy"; then
@@ -139,6 +139,10 @@ if enterAndClear "external/libvpx"; then
 applyPatch "$DOS_PATCHES/android_external_libvpx/CVE-2023-5217-backport.patch"; #VP8: disallow thread count changes
 fi;
 
+if enterAndClear "external/libxml2"; then
+applyPatch "$DOS_PATCHES/android_external_libxml2/367634.patch"; #n-asb-2023-10 malloc-fail: Fix OOB read after xmlRegGetCounter
+fi;
+
 if enterAndClear "external/sonivox"; then
 applyPatch "$DOS_PATCHES/android_external_sonivox/317038.patch"; #n-asb-2021-10 Fix global buffer overflow in WT_InterpolateNoLoop
 fi;
@@ -231,6 +235,10 @@ applyPatch "$DOS_PATCHES/android_frameworks_base/364036-backport.patch"; #R_asb_
 applyPatch "$DOS_PATCHES/android_frameworks_base/364037.patch"; #R_asb_2023-08 Use Settings.System.getIntForUser instead of getInt to make sure user specific settings are used
 applyPatch "$DOS_PATCHES/android_frameworks_base/364038-backport.patch"; #R_asb_2023-08 Resolve StatusHints image exploit across user.
 applyPatch "$DOS_PATCHES/android_frameworks_base/365782.patch"; #n-asb-2023-09 Update AccountManagerService checkKeyIntentParceledCorrectly.
+applyPatch "$DOS_PATCHES/android_frameworks_base/367635.patch"; #n-asb-2023-10 RingtoneManager: verify default ringtone is audio
+applyPatch "$DOS_PATCHES/android_frameworks_base/367636.patch"; #n-asb-2023-10 Fixing DatabaseUtils to detect malformed UTF-16 strings
+applyPatch "$DOS_PATCHES/android_frameworks_base/367637.patch"; #n-asb-2023-10 Do not share key mappings with JNI object
+applyPatch "$DOS_PATCHES/android_frameworks_base/367638.patch"; #n-asb-2023-10 Fix KCM key mapping cloning
 git revert --no-edit 0326bb5e41219cf502727c3aa44ebf2daa19a5b3; #Re-enable doze on devices without gms
 applyPatch "$DOS_PATCHES/android_frameworks_base/248599.patch"; #Make SET_TIME_ZONE permission match SET_TIME (AOSP)
 applyPatch "$DOS_PATCHES/android_frameworks_base/0001-Reduced_Resolution.patch"; #Allow reducing resolution to save power TODO: Add 800x480 (DivestOS)
@@ -405,6 +413,7 @@ applyPatch "$DOS_PATCHES/android_packages_apps_Settings/334874.patch"; #n-asb-20
 applyPatch "$DOS_PATCHES/android_packages_apps_Settings/334875.patch"; #n-asb-2022-08 Fix Settings crash when setting a null ringtone
 applyPatch "$DOS_PATCHES/android_packages_apps_Settings/345679.patch"; #n-asb-2022-12 Add FLAG_SECURE for ChooseLockPassword and Pattern
 applyPatch "$DOS_PATCHES/android_packages_apps_Settings/358738.patch"; #n-asb-2023-06 Convert argument to intent in AddAccountSettings.
+applyPatch "$DOS_PATCHES/android_packages_apps_Settings/367639.patch"; #n-asb-2023-10 Restrict ApnEditor settings
 git revert --no-edit 2ebe6058c546194a301c1fd22963d6be4adbf961; #Don't hide OEM unlock
 applyPatch "$DOS_PATCHES/android_packages_apps_Settings/201113.patch"; #wifi: Add world regulatory domain country code (syphyr)
 applyPatch "$DOS_PATCHES/android_packages_apps_Settings/0001-Captive_Portal_Toggle.patch"; #Add option to disable captive portal checks (MSe1969)