Do not recycle Parcel when lazy value is used
Recycling the parcel when all lazy values are consumed in a bundle may
lead to several UAF issues. However, resources tied to the parcel,
especially file descriptors, should be released as soon as possible, and
it should not wait until the next GC cycle.
To workaround this issue, we expose the destroy() method in Parcel, and
update BaseBundle's implementation to destroy the dangling parcel when
mLazyValues is zero, and never call recycle that may lead to reuse of
these Parcel instances. By doing so, we completely remove any
possibility of UAF with regards to Bundle and lazy values.
Flag: EXEMPT security fix
Test: TH
Bug: 377704076
Bug: 381885240
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:d20f3599f89388d181735db351879d2487cc331b
Merged-In: Ibb28bf81f9028c18baad4e898e387a3e6192db5d
Change-Id: Ibb28bf81f9028c18baad4e898e387a3e6192db5d
3 files changed
