commit 80a84c4aad172de67185e3ecee926df6a429a34a
author Pengquan Meng <mpq@google.com> Fri Mar 09 23:37:01 2018 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Fri Mar 09 23:37:01 2018 +0000
tree 623ab284826b8c094cbb38d1a97d8d678509bdd6
parent 2c7272942845b51a390eb8a71872cb09536c7200
parent a61fe8f6c08bf0d02c0e54db7ffcabde79ea0c3e

Merge changes from topic "am-59911b1f-fa0c-400c-a3f8-812ac0a8762b" into nyc-dev

* changes:
  [automerger] Fixed Security Vulnerability of DcParamObject am: 8c55a70728 am: 61f84448eb am: a007cb0734 am: 3b356d5111
  [automerger] Fixed Security Vulnerability of DcParamObject am: 8c55a70728 am: 61f84448eb am: a007cb0734
  [automerger] Fixed Security Vulnerability of DcParamObject am: 8c55a70728 am: 61f84448eb
  [automerger] Fixed Security Vulnerability of DcParamObject am: 8c55a70728
  Fixed Security Vulnerability of DcParamObject

core/java/com/android/internal/widget/ViewPager.java

diff --git a/core/java/com/android/internal/widget/ViewPager.java b/core/java/com/android/internal/widget/ViewPager.java
index 277fafd..c4dd564 100644
--- a/core/java/com/android/internal/widget/ViewPager.java
+++ b/core/java/com/android/internal/widget/ViewPager.java
@@ -31,6 +31,7 @@
 import android.util.AttributeSet;
 import android.util.Log;
 import android.util.MathUtils;
+import android.view.AbsSavedState;
 import android.view.FocusFinder;
 import android.view.Gravity;
 import android.view.KeyEvent;
@@ -1225,15 +1226,11 @@
      * state, in which case it should implement a subclass of this which
      * contains that state.
      */
-    public static class SavedState extends BaseSavedState {
+    public static class SavedState extends AbsSavedState {
         int position;
         Parcelable adapterState;
         ClassLoader loader;
 
-        public SavedState(Parcel source) {
-            super(source);
-        }
-
         public SavedState(Parcelable superState) {
             super(superState);
         }
@@ -1252,10 +1249,15 @@
                     + " position=" + position + "}";
         }
 
-        public static final Creator<SavedState> CREATOR = new Creator<SavedState>() {
+        public static final Creator<SavedState> CREATOR = new ClassLoaderCreator<SavedState>() {
+            @Override
+            public SavedState createFromParcel(Parcel in, ClassLoader loader) {
+                return new SavedState(in, loader);
+            }
+
             @Override
             public SavedState createFromParcel(Parcel in) {
-                return new SavedState(in);
+                return new SavedState(in, null);
             }
             @Override
             public SavedState[] newArray(int size) {
@@ -1264,7 +1266,7 @@
         };
 
         SavedState(Parcel in, ClassLoader loader) {
-            super(in);
+            super(in, loader);
             if (loader == null) {
                 loader = getClass().getClassLoader();
             }

services/core/java/com/android/server/NetworkManagementService.java

diff --git a/services/core/java/com/android/server/NetworkManagementService.java b/services/core/java/com/android/server/NetworkManagementService.java
index f236877..7996628 100644
--- a/services/core/java/com/android/server/NetworkManagementService.java
+++ b/services/core/java/com/android/server/NetworkManagementService.java
@@ -1852,6 +1852,8 @@
     @Override
     public void setAllowOnlyVpnForUids(boolean add, UidRange[] uidRanges)
             throws ServiceSpecificException {
+        mContext.enforceCallingOrSelfPermission(CONNECTIVITY_INTERNAL, TAG);
+
         try {
             mNetdService.networkRejectNonSecureVpn(add, uidRanges);
         } catch (ServiceSpecificException e) {