| commit | ecafcb8d368a5255202247f07eb1ee457ecec15d | [log] [tgz] |
|---|---|---|
| author | Brian Delwiche <delwiche@google.com> | Thu Oct 05 00:01:03 2023 +0000 |
| committer | android-t1 <android-t1@t2mobile.com> | Wed Nov 29 10:31:31 2023 +0800 |
| tree | 1179afa80e1c9deb39ee25b726964addddf8946b | |
| parent | fbb4d0c861358612ac95d39b1dd7fb279e122775 [diff] |
Fix UAF in ~CallbackEnv com_android_bluetooth_btservice_AdapterService does not null its local JNI environment variable after detaching the thread (which frees the environment context), allowing UAF under certain conditions. Null the variable in this case. Testing here was done through a custom unit test; see patchsets 4-6 for contents. However, unit testing of the JNI layer is problematic in production, so that part of the patch is omitted for final merge. Bug: 291500341 Test: atest bluetooth_test_gd_unit, atest net_test_stack_btm Tag: #security Ignore-AOSP-First: Security (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:5f543d919c4067f2f4925580fd8a690ba3440e80) Merged-In: I3e5e3c51412640aa19f0981caaa809313d6ad030 Change-Id: I3e5e3c51412640aa19f0981caaa809313d6ad030