tree 6efde9e6d81cf61e5cf16e948a9118ade01103f5
parent 4a90c09d18461bd6602d25dee954a67e3642303d
author Svetoslav Ganov <svetoslavganov@google.com> 1481226499 -0800
committer gitbuildkicker <android-build@google.com> 1482193062 -0800

Fix vulnerability in MemoryIntArray

MemoryIntArray was using the size of the undelying
ashmem region to mmap the data but the ashmem size
can be changed until the former is memory mapped.
Since we use the ashmem region size for boundary
checking and memory unmapping if it does not match
the size used while mapping an attacker can force
the system to unmap memory or to access undefined
memory and crash.

Also we were passing the memory address where the
ashmem region is mapped in the owner process to
support cases where the client can pass back the
MemoryIntArray instance. This allows an attacker
to put invalid address and cause arbitrary memory
to be freed.

Now we no longer support passing back the instance
to the owner process (the passed back instance is
read only), so no need to pass the memory adress
of the owner's mapping, thus not allowing freeing
arbitrary memory.

 Further, we now check the memory mapped size against
 the size of the underlying ashmem region after we do
 the memory mapping (to fix the ahsmem size) and if
 an attacker changed the size under us we throw.

 Tests: Updated the tests and they pass.

 bug:33039926
 bug:33042690

Change-Id: I1004579181ff7a223ef659e85c46100c47ab2409
(cherry picked from commit a97171ec499fd876722733f35e51d0d6dbd8d223)