commit 61ecea22d19aae016ea8ad181281d4a5fadcaff0
author Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Fri Sep 23 10:20:42 2022 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Fri Sep 23 10:20:42 2022 +0000
tree 7f5e123d6289d84f99468bf2e015720f21bc8cb6
parent bbdd33611289e3f8eae2c728ef1a0f916aa8f0d7
parent b33603c408a6092db88485112c33938fe8c3e995

Snap for 9098257 from b33603c408a6092db88485112c33938fe8c3e995 to mainline-scheduling-release

Change-Id: Ib2fd0ad674a0e1af02a0d3be3530b0541df652ca

src/com/android/providers/telephony/MmsProvider.java

diff --git a/src/com/android/providers/telephony/MmsProvider.java b/src/com/android/providers/telephony/MmsProvider.java
index b5f8ce0..5ddd6ac 100644
--- a/src/com/android/providers/telephony/MmsProvider.java
+++ b/src/com/android/providers/telephony/MmsProvider.java
@@ -46,6 +46,7 @@
 import android.system.ErrnoException;
 import android.system.Os;
 import android.text.TextUtils;
+import android.util.EventLog;
 import android.util.Log;
 
 import com.google.android.mms.pdu.PduHeaders;
@@ -825,13 +826,21 @@
             case MMS_PART_RESET_FILE_PERMISSION:
                 String path = getContext().getDir(PARTS_DIR_NAME, 0).getPath() + '/' +
                         uri.getPathSegments().get(1);
-                // Reset the file permission back to read for everyone but me.
+
                 try {
+                    String partsDirPath = getContext().getDir(PARTS_DIR_NAME, 0).getCanonicalPath();
+                    if (!new File(path).getCanonicalPath().startsWith(partsDirPath)) {
+                        EventLog.writeEvent(0x534e4554, "240685104",
+                                Binder.getCallingUid(), (TAG + " update: path " + path +
+                                        " does not start with " + partsDirPath));
+                        return 0;
+                    }
+                    // Reset the file permission back to read for everyone but me.
                     Os.chmod(path, 0644);
                     if (LOCAL_LOGV) {
                         Log.d(TAG, "MmsProvider.update chmod is successful for path: " + path);
                     }
-                } catch (ErrnoException e) {
+                } catch (ErrnoException | IOException e) {
                     Log.e(TAG, "Exception in chmod: " + e);
                 }
                 return 0;

tests/src/com/android/providers/telephony/SmsProviderTest.java

diff --git a/tests/src/com/android/providers/telephony/SmsProviderTest.java b/tests/src/com/android/providers/telephony/SmsProviderTest.java
index e4dec77..6a225af 100644
--- a/tests/src/com/android/providers/telephony/SmsProviderTest.java
+++ b/tests/src/com/android/providers/telephony/SmsProviderTest.java
@@ -103,7 +103,7 @@
 
         when(mMockResources
                         .getString(eq(com.android.internal.R.string.config_systemBluetoothStack)))
-                .thenReturn("com.android.bluetooth.services");
+                .thenReturn("com.android.bluetooth");
         when(mContext.getResources()).thenReturn(mMockResources);
         when(mContext.getUserId()).thenReturn(0);