Verify number of Map entries written to Parcel
Make sure the number of entries written by Parcel#writeMapInternal
matches the size written. If a mismatch were allowed, an exploitable
scenario could occur where the data read from the Parcel would not
match the data written.
Change-Id: I325d08a8b66b6e80fe76501359c41b6656848607
Fixes: 112859604
Test: atest android.os.cts.ParcelTest
diff --git a/core/java/android/os/Parcel.java b/core/java/android/os/Parcel.java
index 7e7666a..cc6bb12 100644
--- a/core/java/android/os/Parcel.java
+++ b/core/java/android/os/Parcel.java
@@ -846,11 +846,19 @@
return;
}
Set<Map.Entry<String,Object>> entries = val.entrySet();
- writeInt(entries.size());
+ int size = entries.size();
+ writeInt(size);
+
for (Map.Entry<String,Object> e : entries) {
writeValue(e.getKey());
writeValue(e.getValue());
+ size--;
}
+
+ if (size != 0) {
+ throw new BadParcelableException("Map size does not match number of entries!");
+ }
+
}
/**