Google Git Google Git
Sign in
android/platform/packages/modules/adb/f487f473
commit
f487f473c82d5bfd90f26e7d7ee9cea0cafde353
[log]
author
Joshua Duong <joshuaduong@google.com>
Sun Apr 19 17:06:28 2026 +0000
committer
Android Build Coastguard Worker <android-build-coastguard-worker@google.com>
Thu Jul 09 18:30:37 2026 -0700
tree
afa0fa3e74ebbcfaa5721073adcfb9333120c045
parent
1c97946b5ca6ddf4c1eb756ed82a92dde8934901 [diff] 
[adb] Fix Use-After-Free in TLS handshake.

Fix a Use-After-Free vulnerability in adbd_auth_tls_handshake where a
detached thread captures a raw pointer to an 'atransport' object.

The fix uses the established 'transport-to-callback' flow in adbd auth.
A weak pointer to the transport is captured, and the blocking TLS
handshake is performed in a background thread. All state updates are
serialized back onto the fdevent looper after verifying the transport's
liveness.

Additionally:
- Add a 3-second socket timeout during the TLS handshake in
  FdConnection::DoTlsHandshake for non-host builds to prevent Denial of
  Service.
- Decouple the client and server implementations of DoTlsHandshake into
  separate functions using #ifdefs to improve code readability and
  maintainability.

Bug: 499053500
Test: atest adb_test --host
Flag: EXEMPT BUGFIX
(cherry picked from commit 5651177b24f8410e0c569fbaded96e628f08e3c4)
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:9d6f9c389fb7cfa7c78ca3ea025d4b36b1adbd87
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:d095f99b15647e53b968a27e21d53761d166c6e8
Merged-In: I8ed271ab3f15b812b1fc246f4044730f087a1f9e
Change-Id: I8ed271ab3f15b812b1fc246f4044730f087a1f9e
2 files changed
tree: afa0fa3e74ebbcfaa5721073adcfb9333120c045
  1. apex/
  2. client/
  3. coverage/
  4. crypto/
  5. daemon/
  6. docs/
  7. fastdeploy/
  8. fdevent/
  9. libs/
  10. pairing_auth/
  11. pairing_connection/
  12. proto/
  13. sysdeps/
  14. test_device_apks/
  15. test_utils/
  16. tls/
  17. tools/
  18. .clang-format
  19. adb.bash
  20. adb.cpp
  21. adb.h
  22. adb_auth.h
  23. adb_integration_test_adb.xml
  24. adb_integration_test_device.xml
  25. adb_io.cpp
  26. adb_io.h
  27. adb_io_test.cpp
  28. adb_listeners.cpp
  29. adb_listeners.h
  30. adb_listeners_test.cpp
  31. adb_mdns.cpp
  32. adb_mdns.h
  33. adb_trace.cpp
  34. adb_trace.h
  35. adb_unique_fd.cpp
  36. adb_unique_fd.h
  37. adb_utils.cpp
  38. adb_utils.h
  39. adb_utils_test.cpp
  40. adb_wifi.h
  41. adbd_test.map
  42. adbd_test.xml
  43. Android.bp
  44. apacket_reader.cpp
  45. apacket_reader.h
  46. benchmark_device.py
  47. bugreport_test.cpp
  48. compression_utils.h
  49. file_sync_protocol.h
  50. mdns_test.cpp
  51. MODULE_LICENSE_APACHE2
  52. NOTICE
  53. OWNERS
  54. PREUPLOAD.cfg
  55. README.md
  56. run-device-tests.sh
  57. security_log_tags.h
  58. services.cpp
  59. services.h
  60. shell_protocol.h
  61. shell_service_protocol.cpp
  62. shell_service_protocol_test.cpp
  63. socket.h
  64. socket_spec.cpp
  65. socket_spec.h
  66. socket_spec_test.cpp
  67. socket_test.cpp
  68. sockets.cpp
  69. sockets.dia
  70. sysdeps.h
  71. sysdeps_test.cpp
  72. sysdeps_unix.cpp
  73. sysdeps_win32.cpp
  74. sysdeps_win32_test.cpp
  75. test_adb.py
  76. test_device.py
  77. TEST_MAPPING
  78. trace.sh
  79. transfer_id.h
  80. transport.cpp
  81. transport.h
  82. transport_benchmark.cpp
  83. transport_fd.cpp
  84. transport_test.cpp
  85. types.cpp
  86. types.h
  87. types_test.cpp
README.md

ADB (Android Debug Bridge) repository

The Android Debug Bridge connects Android devices to computers running other OSes (Linux, MacOS, and Windows) over USB or TCP.

User documentation

man page

Developer documentation

main page