Fix vulnerability in LockSettings service am: 2d71384a13 am: 485fbda04c am: 229de7088e am: cb83f6188b
am: e3457fc127
Change-Id: I1bc40c141498e62cad36acc9568177cb88debc11
diff --git a/services/core/java/com/android/server/LockSettingsService.java b/services/core/java/com/android/server/LockSettingsService.java
index 2de09a3..a91e205 100644
--- a/services/core/java/com/android/server/LockSettingsService.java
+++ b/services/core/java/com/android/server/LockSettingsService.java
@@ -1222,6 +1222,9 @@
long challenge, int userId, ICheckCredentialProgressCallback progressCallback)
throws RemoteException {
checkPasswordReadPermission(userId);
+ if (TextUtils.isEmpty(pattern)) {
+ throw new IllegalArgumentException("Pattern can't be null or empty");
+ }
CredentialHash storedHash = mStorage.readPatternHash(userId);
return doVerifyPattern(pattern, storedHash, hasChallenge, challenge, userId,
progressCallback);
@@ -1323,6 +1326,9 @@
long challenge, int userId, ICheckCredentialProgressCallback progressCallback)
throws RemoteException {
checkPasswordReadPermission(userId);
+ if (TextUtils.isEmpty(password)) {
+ throw new IllegalArgumentException("Password can't be null or empty");
+ }
CredentialHash storedHash = mStorage.readPasswordHash(userId);
return doVerifyPassword(password, storedHash, hasChallenge, challenge, userId,
progressCallback);