commit 4208b42895282905cd3885790b57eb61fb0c910a
author Treehugger Robot <treehugger-gerrit@google.com> Thu Nov 17 08:59:37 2022 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Thu Nov 17 08:59:37 2022 +0000
tree 05755e1573c89c8f18ffd8a86e3cfebdbf370d2f
parent 9635ffd93a1b8d1ba6641b2df99a8a3b8ca0fc3d
parent 0272c9d16208c587981295c7d63392942d007ee8

Merge "Carrier ID table rollout all_sdk_carrier_list_Rollout_20221105 Publish the latest carrier id table. This build IS suitable for public release."

src/com/android/providers/telephony/MmsProvider.java

diff --git a/src/com/android/providers/telephony/MmsProvider.java b/src/com/android/providers/telephony/MmsProvider.java
index 04182ac..bc41208 100644
--- a/src/com/android/providers/telephony/MmsProvider.java
+++ b/src/com/android/providers/telephony/MmsProvider.java
@@ -45,6 +45,7 @@
 import android.system.ErrnoException;
 import android.system.Os;
 import android.text.TextUtils;
+import android.util.EventLog;
 import android.util.Log;
 
 import com.android.internal.annotations.VisibleForTesting;
@@ -850,13 +851,21 @@
             case MMS_PART_RESET_FILE_PERMISSION:
                 String path = getContext().getDir(PARTS_DIR_NAME, 0).getPath() + '/' +
                         uri.getPathSegments().get(1);
-                // Reset the file permission back to read for everyone but me.
+
                 try {
+                    String partsDirPath = getContext().getDir(PARTS_DIR_NAME, 0).getCanonicalPath();
+                    if (!new File(path).getCanonicalPath().startsWith(partsDirPath)) {
+                        EventLog.writeEvent(0x534e4554, "240685104",
+                                Binder.getCallingUid(), (TAG + " update: path " + path +
+                                        " does not start with " + partsDirPath));
+                        return 0;
+                    }
+                    // Reset the file permission back to read for everyone but me.
                     Os.chmod(path, 0644);
                     if (LOCAL_LOGV) {
                         Log.d(TAG, "MmsProvider.update chmod is successful for path: " + path);
                     }
-                } catch (ErrnoException e) {
+                } catch (ErrnoException | IOException e) {
                     Log.e(TAG, "Exception in chmod: " + e);
                 }
                 return 0;