commit a6823efeb6f20481b82916d52da0a76a46f7aff8
author Alex Buynytskyy <alexbuy@google.com> Mon Feb 28 14:18:19 2022 -0800
committer Alex Buynytskyy <alexbuy@google.com> Mon Feb 28 16:19:13 2022 -0800
tree 7211acb899dff27fc71912569fe890789c823307
parent beeff2d3fb900c045b2067740ba16fa95dbb7a01

Check incoming array sizes before accessing.

Bug: 220733817
Fixes: 220733817
Test: presubmit
Change-Id: I98972b661fc36906d7d86b366c3f9537dcd17b12

cmds/installd/InstalldNativeService.cpp

diff --git a/cmds/installd/InstalldNativeService.cpp b/cmds/installd/InstalldNativeService.cpp
index 91f7d3b..4e3aae4 100644
--- a/cmds/installd/InstalldNativeService.cpp
+++ b/cmds/installd/InstalldNativeService.cpp
@@ -2010,6 +2010,10 @@
         const std::vector<std::string>& codePaths, std::vector<int64_t>* _aidl_return) {
     ENFORCE_UID(AID_SYSTEM);
     CHECK_ARGUMENT_UUID(uuid);
+    if (packageNames.size() != ceDataInodes.size()) {
+        return exception(binder::Status::EX_ILLEGAL_ARGUMENT,
+                         "packageNames/ceDataInodes size mismatch.");
+    }
     for (const auto& packageName : packageNames) {
         CHECK_ARGUMENT_PACKAGE_NAME(packageName);
     }