Skip to content

Commit 5f8bcea

Browse files
AlamIntelsysopenci
AlamIntel
authored and
sysopenci
committed
ASB JAN 2025 Security Patches integration
Integrating Google Android Security Bulletin Patches Test done: STS r34 All TCs Passed except 2 TCs failed due to Kernel LTS Update requird, Test: KernelLts Test#testRequiredKernelLts_ENFORCING KernelLts Test#testRequiredKernelLts_WARN Update in upcoming ASB WIP. Tracked-On: OAM-128659 Signed-off-by: AlamIntel <sahibex.alam@intel.com>
1 parent 82091de commit 5f8bcea

20 files changed

Lines changed: 3190 additions & 1 deletion

File tree

‎aosp_diff/preliminary/build/make/04_0004-Update-security_patch_level-string.patch‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ index 47bb92c142..2d0ac256a4 100644
2020
# It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
2121
# If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
2222
- PLATFORM_SECURITY_PATCH := 2022-02-05
23-
+ PLATFORM_SECURITY_PATCH := 2024-12-01
23+
+ PLATFORM_SECURITY_PATCH := 2025-01-01
2424
endif
2525
.KATI_READONLY := PLATFORM_SECURITY_PATCH
2626

‎aosp_diff/preliminary/external/giflib/0001-Fix-potential-overflow-when-calculating-ImageSize.bulletin.patch‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
From bb55328d3074ae0bf3fec0d0dc1a125b6606d813 Mon Sep 17 00:00:00 2001
2+
From: Sadaf Ebrahimi <sadafebrahimi@google.com>
3+
Date: Tue, 17 Sep 2024 21:02:42 +0000
4+
Subject: [PATCH] Fix potential overflow when calculating ImageSize
5+
6+
The modified if statement doesn't check the size of ImageDesc.Width and
7+
ImageDesc.Height. If ImageDesc.Width and ImageDesc.Height are larger
8+
than SIZE_MAX, then ImageSize overflows.
9+
10+
Bug: 355461643
11+
Test: TreeHugger
12+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:b379176c0987587a9186ac73b9b1fab2655657ae)
13+
Merged-In: Ieef04e789acf783eda2dff2cd9284ed204f1d117
14+
Change-Id: Ieef04e789acf783eda2dff2cd9284ed204f1d117
15+
---
16+
dgif_lib.c | 6 ++++--
17+
1 file changed, 4 insertions(+), 2 deletions(-)
18+
19+
diff --git a/dgif_lib.c b/dgif_lib.c
20+
index 66a1d6a..7b43a6a 100644
21+
--- a/dgif_lib.c
22+
+++ b/dgif_lib.c
23+
@@ -1099,8 +1099,10 @@ DGifSlurp(GifFileType *GifFile)
24+
25+
sp = &GifFile->SavedImages[GifFile->ImageCount - 1];
26+
/* Allocate memory for the image */
27+
- if (sp->ImageDesc.Width < 0 && sp->ImageDesc.Height < 0 &&
28+
- sp->ImageDesc.Width > (INT_MAX / sp->ImageDesc.Height)) {
29+
+ if (sp->ImageDesc.Width <= 0 ||
30+
+ sp->ImageDesc.Height <= 0 ||
31+
+ sp->ImageDesc.Width >
32+
+ (INT_MAX / sp->ImageDesc.Height)) {
33+
return GIF_ERROR;
34+
}
35+
ImageSize = sp->ImageDesc.Width * sp->ImageDesc.Height;
36+
--
37+
2.46.1.824.gd892dcdcdd-goog
38+

‎aosp_diff/preliminary/frameworks/base/99_0294-RingtoneManager-verify-default-ringtone-is-audio.bulletin.patch‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
From a934acdf8b2293c8c043cbf194d005808d797e1d Mon Sep 17 00:00:00 2001
2+
From: Jean-Michel Trivi <jmtrivi@google.com>
3+
Date: Wed, 7 Dec 2022 04:36:46 +0000
4+
Subject: [PATCH] RingtoneManager: verify default ringtone is audio
5+
6+
When a ringtone picker tries to set a ringtone through
7+
RingtoneManager.setActualDefaultRingtoneUri (also
8+
called by com.android.settings.DefaultRingtonePreference),
9+
verify the mimeType can be obtained (not found when caller
10+
doesn't have access to it) and it is an audio resource.
11+
12+
Bug: 205837340
13+
Test: atest android.media.audio.cts.RingtoneManagerTest
14+
(cherry picked from commit 38618f9fb16d3b5617e2289354d47abe5af17dad)
15+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:a67982c990496d8efded6cc3a7471e30b66dce60)
16+
Merged-In: I3f2c487ded405c0c1a83ef0a2fe99cff7cc9328e
17+
Change-Id: I3f2c487ded405c0c1a83ef0a2fe99cff7cc9328e
18+
---
19+
media/java/android/media/RingtoneManager.java | 19 +++++++++++++++++--
20+
1 file changed, 17 insertions(+), 2 deletions(-)
21+
22+
diff --git a/media/java/android/media/RingtoneManager.java b/media/java/android/media/RingtoneManager.java
23+
index 4ec79b7e085a..8aecf7f17026 100644
24+
--- a/media/java/android/media/RingtoneManager.java
25+
+++ b/media/java/android/media/RingtoneManager.java
26+
@@ -802,10 +802,10 @@ public class RingtoneManager {
27+
28+
return ringtoneUri;
29+
}
30+
-
31+
+
32+
/**
33+
* Sets the {@link Uri} of the default sound for a given sound type.
34+
- *
35+
+ *
36+
* @param context A context used for querying.
37+
* @param type The type whose default sound should be set. One of
38+
* {@link #TYPE_RINGTONE}, {@link #TYPE_NOTIFICATION}, or
39+
@@ -826,6 +826,21 @@ public class RingtoneManager {
40+
if(!isInternalRingtoneUri(ringtoneUri)) {
41+
ringtoneUri = ContentProvider.maybeAddUserId(ringtoneUri, context.getUserId());
42+
}
43+
+
44+
+ if (ringtoneUri != null) {
45+
+ final String mimeType = resolver.getType(ringtoneUri);
46+
+ if (mimeType == null) {
47+
+ Log.e(TAG, "setActualDefaultRingtoneUri for URI:" + ringtoneUri
48+
+ + " ignored: failure to find mimeType (no access from this context?)");
49+
+ return;
50+
+ }
51+
+ if (!(mimeType.startsWith("audio/") || mimeType.equals("application/ogg"))) {
52+
+ Log.e(TAG, "setActualDefaultRingtoneUri for URI:" + ringtoneUri
53+
+ + " ignored: associated mimeType:" + mimeType + " is not an audio type");
54+
+ return;
55+
+ }
56+
+ }
57+
+
58+
Settings.System.putStringForUser(resolver, setting,
59+
ringtoneUri != null ? ringtoneUri.toString() : null, context.getUserId());
60+
61+
--
62+
2.46.1.824.gd892dcdcdd-goog
63+

‎aosp_diff/preliminary/frameworks/base/99_0295-SettingsProvider-verify-ringtone-URI-before-setting.bulletin.patch‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
From 8253d2f95df2c337fee6ecc9bdd5df26db28a57f Mon Sep 17 00:00:00 2001
2+
From: Songchun Fan <schfan@google.com>
3+
Date: Mon, 14 Aug 2023 15:24:11 -0700
4+
Subject: [PATCH] [SettingsProvider] verify ringtone URI before setting
5+
6+
Similar to ag/24422287, but the same URI verification should be done in
7+
SettingsProvider as well, which can be called by apps via
8+
Settings.System API or ContentProvider APIs without using
9+
RingtoneManager.
10+
11+
BUG: 227201030
12+
Test: manual with a test app. Will add a CTS test.
13+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:1b234678ec122994ccbfc52ac48aafdad7fdb1ed)
14+
Merged-In: Ic0ffa1db14b5660d02880b632a7f2ad9e6e5d84b
15+
Change-Id: Ic0ffa1db14b5660d02880b632a7f2ad9e6e5d84b
16+
---
17+
.../providers/settings/SettingsProvider.java | 31 +++++++++++++++++++
18+
1 file changed, 31 insertions(+)
19+
20+
diff --git a/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java b/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
21+
index 205944c9244c..a1d1f21fd3ec 100644
22+
--- a/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
23+
+++ b/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
24+
@@ -1886,6 +1886,9 @@ public class SettingsProvider extends ContentProvider {
25+
cacheName = Settings.System.ALARM_ALERT_CACHE;
26+
}
27+
if (cacheName != null) {
28+
+ if (!isValidAudioUri(name, value)) {
29+
+ return false;
30+
+ }
31+
final File cacheFile = new File(
32+
getRingtoneCacheDir(owningUserId), cacheName);
33+
cacheFile.delete();
34+
@@ -1918,6 +1921,34 @@ public class SettingsProvider extends ContentProvider {
35+
}
36+
}
37+
38+
+ private boolean isValidAudioUri(String name, String uri) {
39+
+ if (uri != null) {
40+
+ Uri audioUri = Uri.parse(uri);
41+
+ if (Settings.AUTHORITY.equals(
42+
+ ContentProvider.getAuthorityWithoutUserId(audioUri.getAuthority()))) {
43+
+ // Don't accept setting the default uri to self-referential URIs like
44+
+ // Settings.System.DEFAULT_RINGTONE_URI, which is an alias to the value of this
45+
+ // setting.
46+
+ return false;
47+
+ }
48+
+ final String mimeType = getContext().getContentResolver().getType(audioUri);
49+
+ if (mimeType == null) {
50+
+ Slog.e(LOG_TAG,
51+
+ "mutateSystemSetting for setting: " + name + " URI: " + audioUri
52+
+ + " ignored: failure to find mimeType (no access from this context?)");
53+
+ return false;
54+
+ }
55+
+ if (!(mimeType.startsWith("audio/") || mimeType.equals("application/ogg")
56+
+ || mimeType.equals("application/x-flac"))) {
57+
+ Slog.e(LOG_TAG,
58+
+ "mutateSystemSetting for setting: " + name + " URI: " + audioUri
59+
+ + " ignored: associated mimeType: " + mimeType + " is not an audio type");
60+
+ return false;
61+
+ }
62+
+ }
63+
+ return true;
64+
+ }
65+
+
66+
private boolean hasWriteSecureSettingsPermission() {
67+
// Write secure settings is a more protected permission. If caller has it we are good.
68+
return getContext().checkCallingOrSelfPermission(Manifest.permission.WRITE_SECURE_SETTINGS)
69+
--
70+
2.46.1.824.gd892dcdcdd-goog
71+

‎aosp_diff/preliminary/frameworks/base/99_0296-RingtoneManager-allow-video-ringtone-URI.bulletin.patch‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
From 470436ffd49178807af144602f286943f229ab17 Mon Sep 17 00:00:00 2001
2+
From: Jean-Michel Trivi <jmtrivi@google.com>
3+
Date: Mon, 24 Jun 2024 17:29:14 -0700
4+
Subject: [PATCH] RingtoneManager: allow video ringtone URI
5+
6+
When checking the MIME type for the default ringtone, also
7+
allow it to refer to video content.
8+
9+
Bug: 205837340
10+
Test: see POC + atest android.media.audio.cts.RingtoneManagerTest
11+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:a8d2785d69314086dc3b5b2531386fefff079ce7)
12+
Merged-In: Iac9f27f14bae29e0fabc31e05da2357f6f4f16c7
13+
Change-Id: Iac9f27f14bae29e0fabc31e05da2357f6f4f16c7
14+
---
15+
media/java/android/media/RingtoneManager.java | 8 ++++++--
16+
.../android/providers/settings/SettingsProvider.java | 11 +++++++----
17+
2 files changed, 13 insertions(+), 6 deletions(-)
18+
19+
diff --git a/media/java/android/media/RingtoneManager.java b/media/java/android/media/RingtoneManager.java
20+
index 8aecf7f17026..2dc6365c2e29 100644
21+
--- a/media/java/android/media/RingtoneManager.java
22+
+++ b/media/java/android/media/RingtoneManager.java
23+
@@ -834,9 +834,13 @@ public class RingtoneManager {
24+
+ " ignored: failure to find mimeType (no access from this context?)");
25+
return;
26+
}
27+
- if (!(mimeType.startsWith("audio/") || mimeType.equals("application/ogg"))) {
28+
+ if (!(mimeType.startsWith("audio/") || mimeType.equals("application/ogg")
29+
+ || mimeType.equals("application/x-flac")
30+
+ // also check for video ringtones
31+
+ || mimeType.startsWith("video/") || mimeType.equals("application/mp4"))) {
32+
Log.e(TAG, "setActualDefaultRingtoneUri for URI:" + ringtoneUri
33+
- + " ignored: associated mimeType:" + mimeType + " is not an audio type");
34+
+ + " ignored: associated MIME type:" + mimeType
35+
+ + " is not a recognized audio or video type");
36+
return;
37+
}
38+
}
39+
diff --git a/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java b/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
40+
index a1d1f21fd3ec..303e79662de3 100644
41+
--- a/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
42+
+++ b/packages/SettingsProvider/src/com/android/providers/settings/SettingsProvider.java
43+
@@ -1886,7 +1886,7 @@ public class SettingsProvider extends ContentProvider {
44+
cacheName = Settings.System.ALARM_ALERT_CACHE;
45+
}
46+
if (cacheName != null) {
47+
- if (!isValidAudioUri(name, value)) {
48+
+ if (!isValidMediaUri(name, value)) {
49+
return false;
50+
}
51+
final File cacheFile = new File(
52+
@@ -1921,7 +1921,7 @@ public class SettingsProvider extends ContentProvider {
53+
}
54+
}
55+
56+
- private boolean isValidAudioUri(String name, String uri) {
57+
+ private boolean isValidMediaUri(String name, String uri) {
58+
if (uri != null) {
59+
Uri audioUri = Uri.parse(uri);
60+
if (Settings.AUTHORITY.equals(
61+
@@ -1939,10 +1939,13 @@ public class SettingsProvider extends ContentProvider {
62+
return false;
63+
}
64+
if (!(mimeType.startsWith("audio/") || mimeType.equals("application/ogg")
65+
- || mimeType.equals("application/x-flac"))) {
66+
+ || mimeType.equals("application/x-flac")
67+
+ // also check for video ringtones
68+
+ || mimeType.startsWith("video/") || mimeType.equals("application/mp4"))) {
69+
Slog.e(LOG_TAG,
70+
"mutateSystemSetting for setting: " + name + " URI: " + audioUri
71+
- + " ignored: associated mimeType: " + mimeType + " is not an audio type");
72+
+ + " ignored: associated MIME type: " + mimeType
73+
+ + " is not a recognized audio or video type");
74+
return false;
75+
}
76+
}
77+
--
78+
2.46.1.824.gd892dcdcdd-goog
79+

‎aosp_diff/preliminary/frameworks/base/99_0297-enforce-limits-for-VisualVoicemailSmsFilterSettings-properties.bulletin.patch‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
From 50ed88a3af4455cc903ba2333e20294490d4f868 Mon Sep 17 00:00:00 2001
2+
From: Thomas Stuart <tjstuart@google.com>
3+
Date: Thu, 6 Jun 2024 22:36:40 +0000
4+
Subject: [PATCH] enforce limits for VisualVoicemailSmsFilterSettings
5+
properties
6+
7+
- clientPrefix is now limited to 256 characters
8+
- originatingNumbers is now limited to a list size of 100 and
9+
each element is also limited to 256 characters
10+
11+
Bug: 308932906
12+
Test: CTS
13+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:71ce82860ab6c072badd935d293fb4ca9d2bb260)
14+
Merged-In: Id4b4358b141bb211a7e340b979774850b4bd2403
15+
Change-Id: Id4b4358b141bb211a7e340b979774850b4bd2403
16+
---
17+
.../VisualVoicemailSmsFilterSettings.java | 27 +++++++++++++++++++
18+
1 file changed, 27 insertions(+)
19+
20+
diff --git a/telephony/java/android/telephony/VisualVoicemailSmsFilterSettings.java b/telephony/java/android/telephony/VisualVoicemailSmsFilterSettings.java
21+
index eadb726bf63b..2b515c9b5cd1 100644
22+
--- a/telephony/java/android/telephony/VisualVoicemailSmsFilterSettings.java
23+
+++ b/telephony/java/android/telephony/VisualVoicemailSmsFilterSettings.java
24+
@@ -64,6 +64,14 @@ public final class VisualVoicemailSmsFilterSettings implements Parcelable {
25+
* @hide
26+
*/
27+
public static final int DEFAULT_DESTINATION_PORT = DESTINATION_PORT_ANY;
28+
+ /**
29+
+ * @hide
30+
+ */
31+
+ public static final int MAX_STRING_LENGTH = 256;
32+
+ /**
33+
+ * @hide
34+
+ */
35+
+ public static final int MAX_LIST_SIZE = 100;
36+
37+
/**
38+
* Builder class for {@link VisualVoicemailSmsFilterSettings} objects.
39+
@@ -82,11 +90,16 @@ public final class VisualVoicemailSmsFilterSettings implements Parcelable {
40+
/**
41+
* Sets the client prefix for the visual voicemail SMS filter. The client prefix will appear
42+
* at the start of a visual voicemail SMS message, followed by a colon(:).
43+
+ * @throws IllegalArgumentException if the string length is greater than 256 characters
44+
*/
45+
public Builder setClientPrefix(String clientPrefix) {
46+
if (clientPrefix == null) {
47+
throw new IllegalArgumentException("Client prefix cannot be null");
48+
}
49+
+ if (clientPrefix.length() > MAX_STRING_LENGTH) {
50+
+ throw new IllegalArgumentException("Client prefix cannot be greater than "
51+
+ + MAX_STRING_LENGTH + " characters");
52+
+ }
53+
mClientPrefix = clientPrefix;
54+
return this;
55+
}
56+
@@ -95,11 +108,25 @@ public final class VisualVoicemailSmsFilterSettings implements Parcelable {
57+
* Sets the originating number allow list for the visual voicemail SMS filter. If the list
58+
* is not null only the SMS messages from a number in the list can be considered as a visual
59+
* voicemail SMS. Otherwise, messages from any address will be considered.
60+
+ * @throws IllegalArgumentException if the size of the originatingNumbers list is greater
61+
+ * than 100 elements
62+
+ * @throws IllegalArgumentException if an element within the originatingNumbers list has
63+
+ * a string length greater than 256
64+
*/
65+
public Builder setOriginatingNumbers(List<String> originatingNumbers) {
66+
if (originatingNumbers == null) {
67+
throw new IllegalArgumentException("Originating numbers cannot be null");
68+
}
69+
+ if (originatingNumbers.size() > MAX_LIST_SIZE) {
70+
+ throw new IllegalArgumentException("The originatingNumbers list size cannot be"
71+
+ + " greater than " + MAX_STRING_LENGTH + " elements");
72+
+ }
73+
+ for (String num : originatingNumbers) {
74+
+ if (num != null && num.length() > MAX_STRING_LENGTH) {
75+
+ throw new IllegalArgumentException("Numbers within the originatingNumbers list"
76+
+ + " cannot be greater than" + MAX_STRING_LENGTH + " characters");
77+
+ }
78+
+ }
79+
mOriginatingNumbers = originatingNumbers;
80+
return this;
81+
}
82+
--
83+
2.46.1.824.gd892dcdcdd-goog
84+

0 commit comments

Comments
 (0)