commit 37229f182997977e84a875cc94e5ac3d299b9c91
author Etan Cohen <etancohen@google.com> Fri Feb 02 08:07:20 2018 -0800
committer JP Sugarbroad <jpsugar@google.com> Tue Feb 13 14:09:09 2018 -0800
tree 3c23c53933c0d24bcb246dfe0b0292ad7c9eed6d
parent 0587e6a8914f0b6657fb4ca16ef382801dc88f43

[RTT] ParcelableRttResults parcel code fix

ParcelableRttResults was unparceled incorrectly.

Bug: 70398564
Test: exploit provided in bug no longer works
Change-Id: Ifd6de547e9861bbebc399b43d0cc2899a8160813
(cherry picked from commit e1e5a2409c8bef2481e68d9329f87bb8037afa45)

wifi/java/android/net/wifi/RttManager.java

diff --git a/wifi/java/android/net/wifi/RttManager.java b/wifi/java/android/net/wifi/RttManager.java
index a4b3bf2a..de9e3cd 100644
--- a/wifi/java/android/net/wifi/RttManager.java
+++ b/wifi/java/android/net/wifi/RttManager.java
@@ -844,8 +844,8 @@
                     }
                     dest.writeByte(result.LCR.id);
                     if (result.LCR.id != (byte) 0xFF) {
-                        dest.writeInt((byte) result.LCR.data.length);
-                        dest.writeByte(result.LCR.id);
+                        dest.writeByte((byte) result.LCR.data.length);
+                        dest.writeByteArray(result.LCR.data);
                     }
                     dest.writeByte(result.secure ? (byte) 1 : 0);
                 }