commit e1e5a2409c8bef2481e68d9329f87bb8037afa45
author Etan Cohen <etancohen@google.com> Fri Feb 02 08:07:20 2018 -0800
committer Etan Cohen <etancohen@google.com> Fri Feb 02 10:11:47 2018 -0800
tree 25e125b7f62c6e2dbf2c6a2031aa946f82f1fa2f
parent 8a0c7fd99e2d76b81d0b5d427b52bfae881071f8

[RTT] ParcelableRttResults parcel code fix

ParcelableRttResults was unparceled incorrectly.

Bug: 70398564
Test: exploit provided in bug no longer works
Change-Id: Ifd6de547e9861bbebc399b43d0cc2899a8160813

wifi/java/android/net/wifi/RttManager.java

diff --git a/wifi/java/android/net/wifi/RttManager.java b/wifi/java/android/net/wifi/RttManager.java
index 503e4a2..ea07033 100644
--- a/wifi/java/android/net/wifi/RttManager.java
+++ b/wifi/java/android/net/wifi/RttManager.java
@@ -730,8 +730,8 @@
                     }
                     dest.writeByte(result.LCR.id);
                     if (result.LCR.id != (byte) 0xFF) {
-                        dest.writeInt((byte) result.LCR.data.length);
-                        dest.writeByte(result.LCR.id);
+                        dest.writeByte((byte) result.LCR.data.length);
+                        dest.writeByteArray(result.LCR.data);
                     }
                 }
             } else {