diff options
| author | Yohann Roussel <yroussel@google.com> | 2017-01-02 15:29:59 +0100 |
|---|---|---|
| committer | Yohann Roussel <yroussel@google.com> | 2017-01-20 14:56:04 +0000 |
| commit | f5832474ebd6ec48f0f37bc1fd9e2576068e4ef2 (patch) | |
| tree | 727b036fa1552b9d735dc9fcb4c53b080622ff92 | |
| parent | b504c8f1b2edc203dca3959d29bc0dcf9e6fc8dd (diff) | |
| download | multidex-f5832474ebd6ec48f0f37bc1fd9e2576068e4ef2.tar.gz | |
Mark extracted dex files as read only
This is a poor protection from some attack against application that
would be made to overwrite their extracted secondary dex files.
The protection is poor because marking the dex files read only will
protect only some applications depending on their implementation.
Test: MultiDexLegacyVersionedTestApp
Bug: 32159214
Change-Id: I88c6fc72284f4e0b832dc4d840c9c636a1234638
| -rw-r--r-- | library/src/android/support/multidex/MultiDexExtractor.java | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/library/src/android/support/multidex/MultiDexExtractor.java b/library/src/android/support/multidex/MultiDexExtractor.java index 177279a..6d09245 100644 --- a/library/src/android/support/multidex/MultiDexExtractor.java +++ b/library/src/android/support/multidex/MultiDexExtractor.java @@ -356,6 +356,10 @@ final class MultiDexExtractor { } finally { out.close(); } + if (!tmp.setReadOnly()) { + throw new IOException("Failed to mark readonly \"" + tmp.getAbsolutePath() + + "\" (tmp of \"" + extractTo.getAbsolutePath() + "\")"); + } Log.i(TAG, "Renaming to " + extractTo.getPath()); if (!tmp.renameTo(extractTo)) { throw new IOException("Failed to rename \"" + tmp.getAbsolutePath() + |