diff options
author | android-build-team Robot <android-build-team-robot@google.com> | 2020-07-14 23:08:27 +0000 |
---|---|---|
committer | android-build-team Robot <android-build-team-robot@google.com> | 2020-07-14 23:08:27 +0000 |
commit | 5036c372db1e8a2564e991d1c65ff1e8e99aac17 (patch) | |
tree | 4e8d04b042c606ac7f8e6c429994818efcc97519 | |
parent | 6d9baf687af434131092783c1b82ea80fc524161 (diff) | |
parent | dea036920cee1f548334be13b7c45c46279d5c8f (diff) | |
download | security-android11-qpr1-d-s1-release.tar.gz |
Snap for 6680110 from dea036920cee1f548334be13b7c45c46279d5c8f to rvc-qpr1-releaseandroid-11.0.0_r24android-11.0.0_r23android-11.0.0_r22android-11.0.0_r21android-11.0.0_r20android-11.0.0_r19android-11.0.0_r18android11-qpr1-s2-releaseandroid11-qpr1-s1-releaseandroid11-qpr1-d-s1-release
Change-Id: I650ca922e645cff0b2f372fd904d272d50caabe9
-rw-r--r-- | identity/Credential.cpp | 23 |
1 files changed, 19 insertions, 4 deletions
diff --git a/identity/Credential.cpp b/identity/Credential.cpp index 59a4d81e..28ba752e 100644 --- a/identity/Credential.cpp +++ b/identity/Credential.cpp @@ -184,7 +184,21 @@ Status Credential::getEntries(const vector<uint8_t>& requestMessage, // in the startRetrieval() call. vector<int32_t> requestCounts; const vector<SecureAccessControlProfile>& allProfiles = data_->getSecureAccessControlProfiles(); - vector<bool> includeProfile(allProfiles.size()); + + // We don't support ACP identifiers which isn't in the range 0 to 31. This + // guarantee exists so it's feasible to implement the TA part of an Identity + // Credential HAL implementation where the TA uses a 32-bit word to indicate + // which profiles are authorized. + for (const SecureAccessControlProfile& profile : allProfiles) { + if (profile.id < 0 || profile.id >= 32) { + return Status::fromServiceSpecificError( + ICredentialStore::ERROR_GENERIC, + "Invalid accessProfileId in profile (must be between 0 and 31)"); + } + } + + vector<bool> includeProfile(32); + for (const RequestNamespaceParcel& rns : requestNamespaces) { size_t numEntriesInNsToRequest = 0; for (const RequestEntryParcel& rep : rns.entries) { @@ -195,11 +209,12 @@ Status Credential::getEntries(const vector<uint8_t>& requestMessage, optional<EntryData> data = data_->getEntryData(rns.namespaceName, rep.name); if (data) { for (int32_t id : data.value().accessControlProfileIds) { - if (id >= int32_t(includeProfile.size())) { + if (id < 0 || id >= 32) { LOG(ERROR) << "Invalid accessControlProfileId " << id << " for " << rns.namespaceName << ": " << rep.name; return Status::fromServiceSpecificError( - ICredentialStore::ERROR_GENERIC, "Invalid accessProfileId for entry"); + ICredentialStore::ERROR_GENERIC, + "Invalid accessProfileId in entry (must be between 0 and 31)"); } includeProfile[id] = true; } @@ -212,7 +227,7 @@ Status Credential::getEntries(const vector<uint8_t>& requestMessage, // HAL. vector<SecureAccessControlProfile> selectedProfiles; for (size_t n = 0; n < allProfiles.size(); n++) { - if (includeProfile[n]) { + if (includeProfile[allProfiles[n].id]) { selectedProfiles.push_back(allProfiles[n]); } } |