summaryrefslogtreecommitdiffstats
path: root/services
diff options
context:
space:
mode:
authorMathias Agopian <mathias@google.com>2012-10-22 14:27:45 -0700
committerAndroid (Google) Code Review <android-gerrit@google.com>2012-10-22 14:54:23 -0700
commitd17e3b5f6cf71eb52bc81f37719254ce08244b34 (patch)
tree65c6059bd12beca43b36d5299337a9d77b4608e4 /services
parentba7dc2db6e93a2407c8c328f2838591b7b760658 (diff)
downloadframeworks_native-d17e3b5f6cf71eb52bc81f37719254ce08244b34.zip
frameworks_native-d17e3b5f6cf71eb52bc81f37719254ce08244b34.tar.gz
frameworks_native-d17e3b5f6cf71eb52bc81f37719254ce08244b34.tar.bz2
prevent a client from crashing surfaceflinger
a misbehaving or malicious client could cause SF to crash by providing a "fake" IInterface. we now check the IInterface we get is our own and local. Bug: 7278879 Change-Id: Ia19d05902d4b2385c5a16416148378d4998833fd
Diffstat (limited to 'services')
-rw-r--r--services/surfaceflinger/SurfaceFlinger.cpp19
1 files changed, 17 insertions, 2 deletions
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 38e02f1..26e9c60 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -1681,8 +1681,23 @@ void SurfaceFlinger::setTransactionState(
count = state.size();
for (size_t i=0 ; i<count ; i++) {
const ComposerState& s(state[i]);
- sp<Client> client( static_cast<Client *>(s.client.get()) );
- transactionFlags |= setClientStateLocked(client, s.state);
+ // Here we need to check that the interface we're given is indeed
+ // one of our own. A malicious client could give us a NULL
+ // IInterface, or one of its own or even one of our own but a
+ // different type. All these situations would cause us to crash.
+ //
+ // NOTE: it would be better to use RTTI as we could directly check
+ // that we have a Client*. however, RTTI is disabled in Android.
+ if (s.client != NULL) {
+ sp<IBinder> binder = s.client->asBinder();
+ if (binder != NULL) {
+ String16 desc(binder->getInterfaceDescriptor());
+ if (desc == ISurfaceComposerClient::descriptor) {
+ sp<Client> client( static_cast<Client *>(s.client.get()) );
+ transactionFlags |= setClientStateLocked(client, s.state);
+ }
+ }
+ }
}
if (transactionFlags) {