From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Sumedh Sen Date: Wed, 17 Jul 2024 17:42:43 +0000 Subject: [PATCH] Check whether installerPackageName contains only valid characters Bug: 341256391 Bug: 307532206 Test: sts-tradefed run sts-dynamic-develop -m CtsSecurityTestCases -t android.security.cts.CVE_2024_0044 (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:7aa86be3077b0ffa3de2345788c7c711fcfb4fe7) Merged-In: I74a172c617d6f5b13f0708092156b657b73b5891 Change-Id: I74a172c617d6f5b13f0708092156b657b73b5891 --- .../com/android/server/pm/PackageInstallerService.java | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/services/core/java/com/android/server/pm/PackageInstallerService.java b/services/core/java/com/android/server/pm/PackageInstallerService.java index 02515cfdc16a..310c56ef1260 100644 --- a/services/core/java/com/android/server/pm/PackageInstallerService.java +++ b/services/core/java/com/android/server/pm/PackageInstallerService.java @@ -609,12 +609,17 @@ public class PackageInstallerService extends IPackageInstaller.Stub implements params.appLabel = TextUtils.trimToSize(params.appLabel, PackageItemInfo.MAX_SAFE_LABEL_LENGTH); - // Validate installer package name. + // Validate requested installer package name. if (params.installerPackageName != null && !isValidPackageName( params.installerPackageName)) { params.installerPackageName = null; } + // Validate installer package name. + if (installerPackageName != null && !isValidPackageName(installerPackageName)) { + installerPackageName = null; + } + String requestedInstallerPackageName = params.installerPackageName != null ? params.installerPackageName : installerPackageName;