commit 7f73448acc6228837f72801c12a871da30375101
author Connor O'Brien <connoro@google.com> Fri Aug 19 23:03:56 2016 +0000
committer android-build-merger <android-build-merger@google.com> Fri Aug 19 23:03:56 2016 +0000
tree 57de0302c7377d992083f1e288ef21f703509281
parent 4e63312ac8240339f491dd887d1045e1aeefba66
parent af8d67e0327a03dfa5411caa96a913402824ecdf

Fix vold vulnerability in FrameworkListener am: 470484d2a2 am: e9e046df6c am: 109024f74a am: b906ad88b9 am: 2fadbb93a4 am: e04054d9bb am: 9745b11db1 am: 2f78b2c3d6 am: 2b5e6d8ffc am: 2427a462c0 am: 6b155c1cc4 am: 2f16eeede6
am: af8d67e032

Change-Id: I305679c5b27db8cbf1c0e496a523eea7320e6d09

include/sysutils/FrameworkListener.h

diff --git a/include/sysutils/FrameworkListener.h b/include/sysutils/FrameworkListener.h
index 18049cd..2137069 100644
--- a/include/sysutils/FrameworkListener.h
+++ b/include/sysutils/FrameworkListener.h
@@ -32,6 +32,7 @@
     int mCommandCount;
     bool mWithSeq;
     FrameworkCommandCollection *mCommands;
+    bool mSkipToNextNullByte;
 
 public:
     FrameworkListener(const char *socketName);

libsysutils/src/FrameworkListener.cpp

diff --git a/libsysutils/src/FrameworkListener.cpp b/libsysutils/src/FrameworkListener.cpp
index e7b3dd6..579ead9 100644
--- a/libsysutils/src/FrameworkListener.cpp
+++ b/libsysutils/src/FrameworkListener.cpp
@@ -49,6 +49,7 @@
     errorRate = 0;
     mCommandCount = 0;
     mWithSeq = withSeq;
+    mSkipToNextNullByte = false;
 }
 
 bool FrameworkListener::onDataAvailable(SocketClient *c) {
@@ -59,10 +60,15 @@
     if (len < 0) {
         SLOGE("read() failed (%s)", strerror(errno));
         return false;
-    } else if (!len)
+    } else if (!len) {
         return false;
-   if(buffer[len-1] != '\0')
+    } else if (buffer[len-1] != '\0') {
         SLOGW("String is not zero-terminated");
+        android_errorWriteLog(0x534e4554, "29831647");
+        c->sendMsg(500, "Command too large for buffer", false);
+        mSkipToNextNullByte = true;
+        return false;
+    }
 
     int offset = 0;
     int i;
@@ -70,11 +76,16 @@
     for (i = 0; i < len; i++) {
         if (buffer[i] == '\0') {
             /* IMPORTANT: dispatchCommand() expects a zero-terminated string */
-            dispatchCommand(c, buffer + offset);
+            if (mSkipToNextNullByte) {
+                mSkipToNextNullByte = false;
+            } else {
+                dispatchCommand(c, buffer + offset);
+            }
             offset = i + 1;
         }
     }
 
+    mSkipToNextNullByte = false;
     return true;
 }