tree 1b0da552914d9e5a9e3cfd0c32cfb84313231aa0
parent 3ecbdaf4339c826fdae8489ebf669e4d4384dc5e
author Charles He <qiurui@google.com> 1500039666 +0100
committer android-build-team Robot <android-build-team-robot@google.com> 1505427499 +0000

Fix security hole in GateKeeperResponse.

GateKeeperResponse has inconsistent writeToParcel() and
createFromParcel() methods, making it possible for a malicious app to
create a Bundle that changes contents after reserialization. Such
Bundles can be used to execute Intents with system privileges.

This CL changes writeToParcel() to make serialization and
deserialization consistent, thus fixing the issue.

Bug: 62998805
Test: use the debug app (see bug)
Change-Id: Ie1c64172c454c3a4b7a0919eb3454f0e38efcd09
(cherry picked from commit e74cae8f7c3e6b12f2bf2b75427ee8f5b53eca3c)