commit 06041db074add181ddf19c3e4235a73c62207495
author Michael Wachenschwanz <mwachens@google.com> Wed May 15 22:58:15 2019 -0700
committer Michael Wachenschwanz <mwachens@google.com> Wed May 15 23:10:02 2019 -0700
tree f5c511bd0c41c293ec5e10ce3c306a048a90d7e9
parent aae9d6c77a404f022645c99d3492c9079ec0e747

Clear the Parcel before writing an exception during a transaction

This prevents any object data from being accidentally overwritten by the
exception, which could cause unexpected malformed objects to be sent
across the transaction.

Test: atest CtsOsTestCases:ParcelTest#testExceptionOverwritesObject
Fixes: 34175893
Change-Id: Iaf80a0ad711762992b8ae60f76d861c97a403013

core/java/android/os/Binder.java

diff --git a/core/java/android/os/Binder.java b/core/java/android/os/Binder.java
index 66ddf21..6178b2b 100644
--- a/core/java/android/os/Binder.java
+++ b/core/java/android/os/Binder.java
@@ -1033,6 +1033,8 @@
                     Log.w(TAG, "Caught a RuntimeException from the binder stub implementation.", e);
                 }
             } else {
+                // Clear the parcel before writing the exception
+                reply.setDataSize(0);
                 reply.setDataPosition(0);
                 reply.writeException(e);
             }