Fix exploit where can hide the fact that a location was mocked
- Even if call setTestProviderLocation() with inconsistent providers,
should still end up with a location that is flagged as mocked
- Bug: 33091107
Change-Id: I39e038f25b975989c2e8651bfd9ec9e74073e6cd
diff --git a/services/java/com/android/server/LocationManagerService.java b/services/java/com/android/server/LocationManagerService.java
index eebd1c5..5a8be7b 100644
--- a/services/java/com/android/server/LocationManagerService.java
+++ b/services/java/com/android/server/LocationManagerService.java
@@ -57,6 +57,8 @@
import android.os.UserHandle;
import android.os.WorkSource;
import android.provider.Settings;
+import android.text.TextUtils;
+import android.util.EventLog;
import android.util.Log;
import android.util.Slog;
import com.android.internal.content.PackageMonitor;
@@ -2247,9 +2249,22 @@
if (mockProvider == null) {
throw new IllegalArgumentException("Provider \"" + provider + "\" unknown");
}
+
+ // Ensure that the location is marked as being mock. There's some logic to do this in
+ // handleLocationChanged(), but it fails if loc has the wrong provider (bug 33091107).
+ Location mock = new Location(loc);
+ mock.setIsFromMockProvider(true);
+
+ if (!TextUtils.isEmpty(loc.getProvider()) && !provider.equals(loc.getProvider())) {
+ // The location has an explicit provider that is different from the mock provider
+ // name. The caller may be trying to fool us via bug 33091107.
+ EventLog.writeEvent(0x534e4554, "33091107", Binder.getCallingUid(),
+ provider + "!=" + loc.getProvider());
+ }
+
// clear calling identity so INSTALL_LOCATION_PROVIDER permission is not required
long identity = Binder.clearCallingIdentity();
- mockProvider.setLocation(loc);
+ mockProvider.setLocation(mock);
Binder.restoreCallingIdentity(identity);
}
}