diff options
| author | Brian Duddie <bduddie@google.com> | 2018-02-15 15:02:29 -0800 |
|---|---|---|
| committer | JP Sugarbroad <jpsugar@google.com> | 2018-03-15 12:58:50 -0700 |
| commit | 19e43aeeb2147138cb0a502da057eb3902372fe7 (patch) | |
| tree | 36d005ad24a26e513e837a6a885de2323ed10a10 | |
| parent | a5530e8d66adbb7a316cffb007ae8dc007b6a8c9 (diff) | |
| download | native-19e43aeeb2147138cb0a502da057eb3902372fe7.tar.gz | |
Add bounds check to sensors direct channel creation
Avoids attempting to read a 0-size array during input validation. Adds
SafetyNet logging when this is triggered.
Also, change the cast for the ashmem size check from int to int64_t to
avoid potential conversion to negative number on 32-bit systems.
Bug: 70986337
Test: run POC, confirm via logs that function bails early
Change-Id: I674285738983f18de3466f9e818d83dabe269b7d
(cherry picked from commit 0eb4624b33aeb375ae431a6b1e2b787c959968fe)
| -rw-r--r-- | services/sensorservice/SensorService.cpp | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/services/sensorservice/SensorService.cpp b/services/sensorservice/SensorService.cpp index d60768c98d..11d1c2a3a9 100644 --- a/services/sensorservice/SensorService.cpp +++ b/services/sensorservice/SensorService.cpp @@ -21,6 +21,7 @@ #include <cutils/properties.h> #include <hardware/sensors.h> #include <hardware_legacy/power.h> +#include <log/log.h> #include <openssl/digest.h> #include <openssl/hmac.h> #include <openssl/rand.h> @@ -986,10 +987,15 @@ sp<ISensorEventConnection> SensorService::createSensorDirectConnection( // check specific to memory type switch(type) { case SENSOR_DIRECT_MEM_TYPE_ASHMEM: { // channel backed by ashmem + if (resource->numFds < 1) { + ALOGE("Ashmem direct channel requires a memory region to be supplied"); + android_errorWriteLog(0x534e4554, "70986337"); // SafetyNet + return nullptr; + } int fd = resource->data[0]; int size2 = ashmem_get_size_region(fd); // check size consistency - if (size2 < static_cast<int>(size)) { + if (size2 < static_cast<int64_t>(size)) { ALOGE("Ashmem direct channel size %" PRIu32 " greater than shared memory size %d", size, size2); return nullptr; |