Signed-off-by: Tad <tad@spotco.us>
This commit is contained in:
Tad 2023-12-07 00:16:40 -05:00
parent d7996e8240
commit c47797d6b9
No known key found for this signature in database
GPG Key ID: B286E9F57A07424B
12 changed files with 41 additions and 41 deletions

View File

@ -1,4 +1,4 @@
From 0d5107c9fa5780919b18cd15c1a4a073ac6ed7cd Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Kweku Adams <kwekua@google.com>
Date: Fri, 23 Sep 2022 21:06:53 +0000
Subject: [PATCH] RESTRICT AUTOMERGE: Drop invalid data.
@ -20,10 +20,10 @@ Change-Id: Ie817aa0993e9046cb313a750d2323cadc8c1ef15
1 file changed, 34 insertions(+), 8 deletions(-)
diff --git a/core/java/android/os/PersistableBundle.java b/core/java/android/os/PersistableBundle.java
index db9f4b14a345e..c3e4b759b103c 100644
index db9f4b14a345..c3e4b759b103 100644
--- a/core/java/android/os/PersistableBundle.java
+++ b/core/java/android/os/PersistableBundle.java
@@ -18,6 +18,7 @@
@@ -18,6 +18,7 @@ package android.os;
import android.annotation.Nullable;
import android.util.ArrayMap;
@ -31,7 +31,7 @@ index db9f4b14a345e..c3e4b759b103c 100644
import com.android.internal.util.XmlUtils;
@@ -36,6 +37,8 @@
@@ -36,6 +37,8 @@ import java.io.IOException;
*/
public final class PersistableBundle extends BaseBundle implements Cloneable, Parcelable,
XmlUtils.WriteMapCallback {
@ -40,7 +40,7 @@ index db9f4b14a345e..c3e4b759b103c 100644
private static final String TAG_PERSISTABLEMAP = "pbundle_as_map";
public static final PersistableBundle EMPTY;
@@ -95,7 +98,11 @@ public PersistableBundle(PersistableBundle b) {
@@ -95,7 +98,11 @@ public final class PersistableBundle extends BaseBundle implements Cloneable, Pa
* @hide
*/
public PersistableBundle(Bundle b) {
@ -53,7 +53,7 @@ index db9f4b14a345e..c3e4b759b103c 100644
}
/**
@@ -104,7 +111,7 @@ public PersistableBundle(Bundle b) {
@@ -104,7 +111,7 @@ public final class PersistableBundle extends BaseBundle implements Cloneable, Pa
* @param map a Map containing only those items that can be persisted.
* @throws IllegalArgumentException if any element of #map cannot be persisted.
*/
@ -62,7 +62,7 @@ index db9f4b14a345e..c3e4b759b103c 100644
super();
mFlags = FLAG_DEFUSABLE;
@@ -113,16 +120,23 @@ private PersistableBundle(ArrayMap<String, Object> map) {
@@ -113,16 +120,23 @@ public final class PersistableBundle extends BaseBundle implements Cloneable, Pa
// Now verify each item throwing an exception if there is a violation.
final int N = mMap.size();
@ -91,7 +91,7 @@ index db9f4b14a345e..c3e4b759b103c 100644
}
}
}
@@ -217,6 +231,15 @@ public void writeUnknownObject(Object v, String name, XmlSerializer out)
@@ -217,6 +231,15 @@ public final class PersistableBundle extends BaseBundle implements Cloneable, Pa
/** @hide */
public void saveToXml(XmlSerializer out) throws IOException, XmlPullParserException {
unparcel();
@ -107,7 +107,7 @@ index db9f4b14a345e..c3e4b759b103c 100644
XmlUtils.writeMapXml(mMap, out, this);
}
@@ -265,9 +288,12 @@ public static PersistableBundle restoreFromXml(XmlPullParser in) throws IOExcept
@@ -265,9 +288,12 @@ public final class PersistableBundle extends BaseBundle implements Cloneable, Pa
while (((event = in.next()) != XmlPullParser.END_DOCUMENT) &&
(event != XmlPullParser.END_TAG || in.getDepth() < outerDepth)) {
if (event == XmlPullParser.START_TAG) {

View File

@ -1,4 +1,4 @@
From a341bc7b7ae161f4a87e996d8a5e8b1ad005fb6b Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Pinyao Ting <pinyaoting@google.com>
Date: Mon, 24 Jul 2023 14:58:56 -0700
Subject: [PATCH] Validate userId when publishing shortcuts
@ -13,10 +13,10 @@ Change-Id: Idbde676f871db83825155730e3714f3727e25762
1 file changed, 4 insertions(+)
diff --git a/services/core/java/com/android/server/pm/ShortcutService.java b/services/core/java/com/android/server/pm/ShortcutService.java
index 944f75345df6f..2cfc3461c6977 100644
index 944f75345df6..2cfc3461c697 100644
--- a/services/core/java/com/android/server/pm/ShortcutService.java
+++ b/services/core/java/com/android/server/pm/ShortcutService.java
@@ -1528,6 +1528,10 @@ private void verifyShortcutInfoPackage(String callerPackage, ShortcutInfo si) {
@@ -1528,6 +1528,10 @@ public class ShortcutService extends IShortcutService.Stub {
android.util.EventLog.writeEvent(0x534e4554, "109824443", -1, "");
throw new SecurityException("Shortcut package name mismatch");
}

View File

@ -1,4 +1,4 @@
From cb95e01ba40c3b8c70f5810efb7abfd85bfd0b1f Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Kunal Malhotra <malhk@google.com>
Date: Thu, 2 Feb 2023 23:48:27 +0000
Subject: [PATCH] Adding in verification of calling UID in onShellCommand
@ -14,10 +14,10 @@ Change-Id: I68903ebd6d3d85f4bc820b745e3233a448b62273
1 file changed, 7 insertions(+)
diff --git a/services/core/java/com/android/server/am/ActivityManagerService.java b/services/core/java/com/android/server/am/ActivityManagerService.java
index 4e48f422a2fe3..7cda7571df70d 100644
index a96ad5e24399..c682ba2f7572 100644
--- a/services/core/java/com/android/server/am/ActivityManagerService.java
+++ b/services/core/java/com/android/server/am/ActivityManagerService.java
@@ -14349,6 +14349,13 @@ public int getMemoryTrimLevel() {
@@ -14402,6 +14402,13 @@ public final class ActivityManagerService extends ActivityManagerNative
@Override
public void onShellCommand(FileDescriptor in, FileDescriptor out,
FileDescriptor err, String[] args, ResultReceiver resultReceiver) {

View File

@ -1,4 +1,4 @@
From fd90a5342af9b9ead4026a70a694d3f31908d5ea Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Brian Delwiche <delwiche@google.com>
Date: Thu, 5 Oct 2023 00:01:03 +0000
Subject: [PATCH] Fix UAF in ~CallbackEnv

View File

@ -1,4 +1,4 @@
From e54bad92576d31fc959342e4c35d73abaf29d926 Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: balakrishna <quic_kunthumu@quicinc.com>
Date: Tue, 7 Mar 2023 16:53:46 +0530
Subject: [PATCH] BT: Fixing the rfc_slot_id overflow
@ -17,7 +17,7 @@ Change-Id: I5d7efa34bfb97a6dd8e9d68615d29120a0ae51f0
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/btif/src/btif_sock_rfc.c b/btif/src/btif_sock_rfc.c
index d5522b739eb..d77c3f44253 100644
index d5522b739..d77c3f442 100644
--- a/btif/src/btif_sock_rfc.c
+++ b/btif/src/btif_sock_rfc.c
@@ -225,8 +225,11 @@ static rfc_slot_t *alloc_rfc_slot(const bt_bdaddr_t *addr, const char *name, con

View File

@ -1,4 +1,4 @@
From e446be9bf42b2559add74d48b91bae52b828e24f Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: balakrishna <quic_kunthumu@quicinc.com>
Date: Wed, 24 May 2023 13:28:21 +0530
Subject: [PATCH] Fix OOB Write in pin_reply in bluetooth.cc
@ -17,15 +17,15 @@ Change-Id: I15a1eae59b17f633e29180a01676c260189b8353
1 file changed, 2 insertions(+)
diff --git a/btif/src/bluetooth.c b/btif/src/bluetooth.c
index d2f81733da4..5fc6c880db0 100644
index b6552e251..121ad7314 100644
--- a/btif/src/bluetooth.c
+++ b/btif/src/bluetooth.c
@@ -345,6 +345,8 @@ static int pin_reply(const bt_bdaddr_t *bd_addr, uint8_t accept,
@@ -346,6 +346,8 @@ static int pin_reply(const bt_bdaddr_t *bd_addr, uint8_t accept,
/* sanity check */
if (interface_ready() == FALSE)
return BT_STATUS_NOT_READY;
+ if (pin_code == NULL || pin_len > PIN_CODE_LEN)
+ return BT_STATUS_FAIL;
return btif_dm_pin_reply(bd_addr, accept, pin_len, pin_code);
}
memcpy(&tmp_pin_code, pin_code, pin_len);
return btif_dm_pin_reply(bd_addr, accept, pin_len, &tmp_pin_code);

View File

@ -1,4 +1,4 @@
From 277464e315d43f3d66e2444744dfa9e42977c64c Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Hui Peng <phui@google.com>
Date: Sat, 2 Sep 2023 04:20:10 +0000
Subject: [PATCH] Reject access to secure service authenticated from a temp
@ -20,7 +20,7 @@ Change-Id: Idef4ea28eb3d17b0807ab7dc6849433ddc5581b3
1 file changed, 37 insertions(+), 4 deletions(-)
diff --git a/stack/btm/btm_sec.c b/stack/btm/btm_sec.c
index b27b7e071c7..23b334ce27f 100644
index f8884b917..44d510d3b 100644
--- a/stack/btm/btm_sec.c
+++ b/stack/btm/btm_sec.c
@@ -106,7 +106,7 @@ static BOOLEAN btm_sec_set_security_level ( CONNECTION_TYPE conn_type, char *p_
@ -86,7 +86,7 @@ index b27b7e071c7..23b334ce27f 100644
}
}
else
@@ -5587,6 +5612,14 @@ extern tBTM_STATUS btm_sec_execute_procedure (tBTM_SEC_DEV_REC *p_dev_rec)
@@ -5569,6 +5594,14 @@ extern tBTM_STATUS btm_sec_execute_procedure (tBTM_SEC_DEV_REC *p_dev_rec)
}
}

View File

@ -1,4 +1,4 @@
From 477c17c9d164ea056d9e32e215b8d54d757c9374 Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Hui Peng <phui@google.com>
Date: Sat, 2 Sep 2023 04:27:29 +0000
Subject: [PATCH] Reject access to secure services authenticated from temp
@ -20,7 +20,7 @@ Change-Id: I10fcc2dcd78fc22ffbe3c425669fc9889b94a166
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/stack/btm/btm_sec.c b/stack/btm/btm_sec.c
index 23b334ce27..21af82f8eb 100644
index 44d510d3b..728861f2f 100644
--- a/stack/btm/btm_sec.c
+++ b/stack/btm/btm_sec.c
@@ -2648,8 +2648,13 @@ tBTM_STATUS btm_sec_mx_access_request (BD_ADDR bd_addr, UINT16 psm, BOOLEAN is_o

View File

@ -1,4 +1,4 @@
From b04b44ae7eacd4fab4c8308ce15c2186f254180e Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Hui Peng <phui@google.com>
Date: Tue, 12 Sep 2023 23:47:48 +0000
Subject: [PATCH] Reject access to secure service authenticated from a temp
@ -22,7 +22,7 @@ Change-Id: If1f7c9278a9e877f64ae78b6f067c597fb5d0e66
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/stack/btm/btm_sec.c b/stack/btm/btm_sec.c
index 21af82f8eb..ab97de8564 100644
index 728861f2f..c603156ff 100644
--- a/stack/btm/btm_sec.c
+++ b/stack/btm/btm_sec.c
@@ -2356,15 +2356,15 @@ tBTM_STATUS btm_sec_l2cap_access_req (BD_ADDR bd_addr, UINT16 psm, UINT16 handle

View File

@ -1,4 +1,4 @@
From bf351819da52628f46d4fe11d7e58d4460e7d546 Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Hui Peng <phui@google.com>
Date: Tue, 12 Sep 2023 23:54:08 +0000
Subject: [PATCH] Reorganize the code for checking auth requirement
@ -20,10 +20,10 @@ Change-Id: I976a5a6d7bb819fd6accdc71eb1501b9606f3ae4
1 file changed, 66 insertions(+), 33 deletions(-)
diff --git a/stack/btm/btm_sec.c b/stack/btm/btm_sec.c
index ab97de8564..39b9486f41 100644
index c603156ff..fa85bc28c 100644
--- a/stack/btm/btm_sec.c
+++ b/stack/btm/btm_sec.c
@@ -5519,53 +5519,86 @@ extern tBTM_STATUS btm_sec_execute_procedure (tBTM_SEC_DEV_REC *p_dev_rec)
@@ -5501,53 +5501,86 @@ extern tBTM_STATUS btm_sec_execute_procedure (tBTM_SEC_DEV_REC *p_dev_rec)
/* If connection is not authenticated and authentication is required */
/* start authentication and return PENDING to the caller */

View File

@ -1,4 +1,4 @@
From eb5838d3c34231efb1ab700d91b596247f4a4898 Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Hui Peng <phui@google.com>
Date: Wed, 13 Sep 2023 00:00:44 +0000
Subject: [PATCH] Enforce authentication if encryption is required
@ -21,10 +21,10 @@ Change-Id: I0370ed2e3166d56f708e1981c2126526e1db9eaa
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/stack/btm/btm_sec.c b/stack/btm/btm_sec.c
index 39b9486f41..a43fdcafeb 100644
index fa85bc28c..1a21bce09 100644
--- a/stack/btm/btm_sec.c
+++ b/stack/btm/btm_sec.c
@@ -5528,17 +5528,19 @@ extern tBTM_STATUS btm_sec_execute_procedure (tBTM_SEC_DEV_REC *p_dev_rec)
@@ -5510,17 +5510,19 @@ extern tBTM_STATUS btm_sec_execute_procedure (tBTM_SEC_DEV_REC *p_dev_rec)
{
if (p_dev_rec->is_originator)
{

View File

@ -1,4 +1,4 @@
From 892310be92b62dc2bd3447546dd385534ce8a695 Mon Sep 17 00:00:00 2001
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Brian Delwiche <delwiche@google.com>
Date: Tue, 3 Oct 2023 21:27:49 +0000
Subject: [PATCH] Fix timing attack in BTM_BleVerifySignature
@ -23,7 +23,7 @@ Change-Id: I41a9b586d663d2ad4694222ae451d2d30a428a3c
3 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/main/Android.mk b/main/Android.mk
index 2286997e8d3..985851add33 100644
index 2286997e8..985851add 100644
--- a/main/Android.mk
+++ b/main/Android.mk
@@ -52,12 +52,14 @@ LOCAL_C_INCLUDES+= . \
@ -42,7 +42,7 @@ index 2286997e8d3..985851add33 100644
liblog \
libz \
diff --git a/stack/Android.mk b/stack/Android.mk
index 4c77e8dd7f4..49f43fbc5df 100644
index 4c77e8dd7..49f43fbc5 100644
--- a/stack/Android.mk
+++ b/stack/Android.mk
@@ -33,7 +33,8 @@ LOCAL_C_INCLUDES:= \
@ -65,7 +65,7 @@ index 4c77e8dd7f4..49f43fbc5df 100644
LOCAL_CFLAGS += $(bluetooth_CFLAGS)
diff --git a/stack/btm/btm_ble.c b/stack/btm/btm_ble.c
index 51fd748c074..9e248e96580 100644
index 6bb85a4ce..c6e699d49 100644
--- a/stack/btm/btm_ble.c
+++ b/stack/btm/btm_ble.c
@@ -41,6 +41,7 @@
@ -76,7 +76,7 @@ index 51fd748c074..9e248e96580 100644
#include "osi/include/log.h"
#include "smp_api.h"
@@ -2280,7 +2281,7 @@ BOOLEAN BTM_BleVerifySignature (BD_ADDR bd_addr, UINT8 *p_orig, UINT16 len, UINT
@@ -2282,7 +2283,7 @@ BOOLEAN BTM_BleVerifySignature (BD_ADDR bd_addr, UINT8 *p_orig, UINT16 len, UINT
if (aes_cipher_msg_auth_code(p_rec->ble.keys.pcsrk, p_orig, len, BTM_CMAC_TLEN_SIZE, p_mac))
{