frameworks/base
Revisión | 114df4642694524969ca24749fc4cd81f91679fb (tree) |
---|---|
Tiempo | 2019-06-11 03:35:12 |
Autor | Michael Wachenschwanz <mwachens@goog...> |
Commiter | Nikoli Cartagena |
Clear the Parcel before writing an exception during a transaction
This prevents any object data from being accidentally overwritten by the
exception, which could cause unexpected malformed objects to be sent
across the transaction.
Test: atest CtsOsTestCases:ParcelTest#testExceptionOverwritesObject
Bug: 34175893
Change-Id: Iaf80a0ad711762992b8ae60f76d861c97a403013
Merged-In: Iaf80a0ad711762992b8ae60f76d861c97a403013
(cherry picked from commit f8ef5bcf21c87d8617f5e11810cc94350298d114)
@@ -574,6 +574,8 @@ public class Binder implements IBinder { | ||
574 | 574 | Log.w(TAG, "Caught a RuntimeException from the binder stub implementation.", e); |
575 | 575 | } |
576 | 576 | } else { |
577 | + // Clear the parcel before writing the exception | |
578 | + reply.setDataSize(0); | |
577 | 579 | reply.setDataPosition(0); |
578 | 580 | reply.writeException(e); |
579 | 581 | } |