tag 535f8ec00391c85c93c46b60d604f72005561fb3
tagger The Android Open Source Project <initial-contribution@android.com> Tue Jan 09 17:50:34 2018 -0800
object 6b2b0bd7c771c698f11d7be89c2c57c8722c7454

Android CTS 7.0 Release 17 (4486155)

commit 6b2b0bd7c771c698f11d7be89c2c57c8722c7454
author Rohan Shah <shahrk@google.com> Wed Aug 17 11:23:26 2016 -0700
committer gitbuildkicker <android-build@google.com> Fri Aug 26 10:41:00 2016 -0700
tree ca0ddef78980f66a5266276dd8fbfbf9ff75ce2d
parent 05ddb0c52e9080c7e2b77bfd94c155701544af71

Limit account id and id to longs

The security issue occurs because id is allowed to be an arbitrary
path instead of being limited to what it is -- a long. Both id
and account id are now parsed into longs (and if either fails, an
error will be logged and null will be returned).

Tested/verified error is logged using the reported attack.

BUG=30745403

Change-Id: Ia21418545bbaeb96fb5ab6c3f4e71858e57b8684
(cherry picked from commit 9794d7e8216138adf143a3b6faf3d5683316a662)