summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTom O'Neill <tomo@google.com>2016-12-22 17:59:47 +0000
committerandroid-merger <android-merger@vpba3.mtv.corp.google.com>2017-01-19 16:48:31 -0800
commitd22261fef84481651e12995062105239d551cbc6 (patch)
tree833fdde561c5983bc96c20b0431584a04c9a8ac9
parentf4bed684c939b0f8809ef404b8609fe4ef849263 (diff)
downloadandroid-frameworks-base-d22261fef84481651e12995062105239d551cbc6.tar.gz
android-frameworks-base-d22261fef84481651e12995062105239d551cbc6.tar.xz
Fix exploit where can hide the fact that a location was mocked am: a206a0f17e am: d417e54872 am: 3380a77516 am: 0a8978f04b am: 1684e5f344 am: d28eef0cc2 am: 1f458fdc66 am: d82f8a67fc am: 1ac8affd51 am: 56098f81b6 am: 7cec76de0f
am: 2da05d0f9e Change-Id: I8c94a06f5fa722312436484609bafcb0585d6d18
-rw-r--r--services/core/java/com/android/server/LocationManagerService.java17
1 files changed, 16 insertions, 1 deletions
diff --git a/services/core/java/com/android/server/LocationManagerService.java b/services/core/java/com/android/server/LocationManagerService.java
index 64ca2e3..c9b59ade 100644
--- a/services/core/java/com/android/server/LocationManagerService.java
+++ b/services/core/java/com/android/server/LocationManagerService.java
@@ -87,6 +87,8 @@ import android.os.UserHandle;
import android.os.UserManager;
import android.os.WorkSource;
import android.provider.Settings;
+import android.text.TextUtils;
+import android.util.EventLog;
import android.util.Log;
import android.util.Slog;
@@ -2552,9 +2554,22 @@ public class LocationManagerService extends ILocationManager.Stub {
if (mockProvider == null) {
throw new IllegalArgumentException("Provider \"" + provider + "\" unknown");
}
+
+ // Ensure that the location is marked as being mock. There's some logic to do this in
+ // handleLocationChanged(), but it fails if loc has the wrong provider (bug 33091107).
+ Location mock = new Location(loc);
+ mock.setIsFromMockProvider(true);
+
+ if (!TextUtils.isEmpty(loc.getProvider()) && !provider.equals(loc.getProvider())) {
+ // The location has an explicit provider that is different from the mock provider
+ // name. The caller may be trying to fool us via bug 33091107.
+ EventLog.writeEvent(0x534e4554, "33091107", Binder.getCallingUid(),
+ provider + "!=" + loc.getProvider());
+ }
+
// clear calling identity so INSTALL_LOCATION_PROVIDER permission is not required
long identity = Binder.clearCallingIdentity();
- mockProvider.setLocation(loc);
+ mockProvider.setLocation(mock);
Binder.restoreCallingIdentity(identity);
}
}