mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-12-15 02:44:23 -05:00
54 lines
2.3 KiB
Diff
54 lines
2.3 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Chris Wailes <chriswailes@google.com>
|
|
Date: Thu, 18 Apr 2019 18:25:57 -0700
|
|
Subject: [PATCH] Adds additional sanitization for Zygote command arguments.
|
|
|
|
Previously we were only insuring that the arguments provided to the
|
|
Zygote didn't contain any newlines. This adds additional checks for
|
|
carriage returns and standalone integer arguments to protect against
|
|
malicious argument and packet injection respectively.
|
|
|
|
Bug: 130164289
|
|
Test: m & flash & boot & check logs
|
|
Change-Id: I4055c50d52db0047c02c11096710fd07b429660c
|
|
Merged-In: I4055c50d52db0047c02c11096710fd07b429660c
|
|
(cherry picked from commit c99198249f8bb79487d4f9f0f45b5b2fefaba41a)
|
|
---
|
|
core/java/android/os/ZygoteProcess.java | 9 +++++++--
|
|
1 file changed, 7 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/core/java/android/os/ZygoteProcess.java b/core/java/android/os/ZygoteProcess.java
|
|
index 7a13ee89d393..d3eb9ae05fe4 100644
|
|
--- a/core/java/android/os/ZygoteProcess.java
|
|
+++ b/core/java/android/os/ZygoteProcess.java
|
|
@@ -16,6 +16,7 @@
|
|
|
|
package android.os;
|
|
|
|
+import android.annotation.NonNull;
|
|
import android.net.LocalSocket;
|
|
import android.net.LocalSocketAddress;
|
|
import android.util.Log;
|
|
@@ -253,15 +254,19 @@ public class ZygoteProcess {
|
|
*/
|
|
@GuardedBy("mLock")
|
|
private static Process.ProcessStartResult zygoteSendArgsAndGetResult(
|
|
- ZygoteState zygoteState, ArrayList<String> args)
|
|
+ ZygoteState zygoteState, @NonNull ArrayList<String> args)
|
|
throws ZygoteStartFailedEx {
|
|
try {
|
|
// Throw early if any of the arguments are malformed. This means we can
|
|
// avoid writing a partial response to the zygote.
|
|
int sz = args.size();
|
|
for (int i = 0; i < sz; i++) {
|
|
+ // Making two indexOf calls here is faster than running a manually fused loop due
|
|
+ // to the fact that indexOf is a optimized intrinsic.
|
|
if (args.get(i).indexOf('\n') >= 0) {
|
|
- throw new ZygoteStartFailedEx("embedded newlines not allowed");
|
|
+ throw new ZygoteStartFailedEx("Embedded newlines not allowed");
|
|
+ } else if (args.get(i).indexOf('\r') >= 0) {
|
|
+ throw new ZygoteStartFailedEx("Embedded carriage returns not allowed");
|
|
}
|
|
}
|
|
|