Verify number of Map entries written to Parcel
Make sure the number of entries written by Parcel#writeMapInternal
matches the size written. If a mismatch were allowed, an exploitable
scenario could occur where the data read from the Parcel would not
match the data written.
Fixes: 112859604
Test: cts-tradefed run cts -m CtsOsTestCases -t android.os.cts.ParcelTest
Change-Id: I325d08a8b66b6e80fe76501359c41b6656848607
Merged-In: I325d08a8b66b6e80fe76501359c41b6656848607
(cherry picked from commit 057a01d1f38e9b46d3faa4059fdd7c8717681ea0)
diff --git a/core/java/android/os/Parcel.java b/core/java/android/os/Parcel.java
index 5142928..460f125 100644
--- a/core/java/android/os/Parcel.java
+++ b/core/java/android/os/Parcel.java
@@ -835,11 +835,19 @@
return;
}
Set<Map.Entry<String,Object>> entries = val.entrySet();
- writeInt(entries.size());
+ int size = entries.size();
+ writeInt(size);
+
for (Map.Entry<String,Object> e : entries) {
writeValue(e.getKey());
writeValue(e.getValue());
+ size--;
}
+
+ if (size != 0) {
+ throw new BadParcelableException("Map size does not match number of entries!");
+ }
+
}
/**
