Skip to content

Commit c802b4d

Browse files
AlamIntelsysopenci
authored andcommitted
ASB-NOV 2024 Security Patches integration
Integrating Google Android Security Bulletin Patches Test done: STS r32 TCs Passed. Tracked-On: OAM-126589 Signed-off-by: AlamIntel <sahibex.alam@intel.com>
1 parent c661d1c commit c802b4d

16 files changed

Lines changed: 1444 additions & 1 deletion

aosp_diff/preliminary/build/make/04_0004-Update-security_patch_level-string.patch

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ index 47bb92c142..2d0ac256a4 100644
2020
# It must match one of the Android Security Patch Level strings of the Public Security Bulletins.
2121
# If there is no $PLATFORM_SECURITY_PATCH set, keep it empty.
2222
- PLATFORM_SECURITY_PATCH := 2022-02-05
23-
+ PLATFORM_SECURITY_PATCH := 2024-10-01
23+
+ PLATFORM_SECURITY_PATCH := 2024-11-01
2424
endif
2525
.KATI_READONLY := PLATFORM_SECURITY_PATCH
2626

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
From def9e324366a15e7e53f092f6d2e4f190dda285e Mon Sep 17 00:00:00 2001
2+
From: Brian Osman <brianosman@google.com>
3+
Date: Tue, 27 Aug 2024 14:22:52 -0400
4+
Subject: [PATCH] RESTRICT AUTOMERGE: Avoid potential overflow when allocating
5+
3D mask from emboss filter
6+
7+
Note: the original fix landed after
8+
Iac8b937e516dbfbbcefef54360dd5b7300bacb67 introduced SkMaskBuilder, so
9+
this cherry-pick had to be tweaked to avoid conflicts. Unfortuantely
10+
that means we need RESTRICT AUTOMERGE to prevent this modified version
11+
from flowing through API boundaries into VIC, and we need to manually
12+
cherry-pick it to each API level.
13+
14+
Bug: 344620577
15+
Test: N/A -- unclear if even reachable
16+
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/893738
17+
Commit-Queue: Brian Osman <brianosman@google.com>
18+
Reviewed-by: Ben Wagner <bungeman@google.com>
19+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:2bc38734eec777bf2574d4b38a7fd4fc05f0ecde)
20+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:69fc79acf3f05f269c55069ba5e2fbd00e1a76b6)
21+
Merged-In: Ia35860371d45120baca63238e77faa5c0eb25d51
22+
Change-Id: Ia35860371d45120baca63238e77faa5c0eb25d51
23+
---
24+
src/effects/SkEmbossMaskFilter.cpp | 10 ++++++----
25+
1 file changed, 6 insertions(+), 4 deletions(-)
26+
27+
diff --git a/src/effects/SkEmbossMaskFilter.cpp b/src/effects/SkEmbossMaskFilter.cpp
28+
index 73210a37b4..e465f69d11 100644
29+
--- a/src/effects/SkEmbossMaskFilter.cpp
30+
+++ b/src/effects/SkEmbossMaskFilter.cpp
31+
@@ -96,11 +96,13 @@ bool SkEmbossMaskFilter::filterMask(SkMask* dst, const SkMask& src,
32+
33+
{
34+
uint8_t* alphaPlane = dst->fImage;
35+
- size_t planeSize = dst->computeImageSize();
36+
- if (0 == planeSize) {
37+
- return false; // too big to allocate, abort
38+
+ size_t totalSize = dst->computeTotalImageSize();
39+
+ if (totalSize == 0) {
40+
+ return false; // too big to allocate, abort
41+
}
42+
- dst->fImage = SkMask::AllocImage(planeSize * 3);
43+
+ size_t planeSize = dst->computeImageSize();
44+
+ SkASSERT(planeSize != 0); // if totalSize didn't overflow, this can't either
45+
+ dst->fImage = SkMask::AllocImage(totalSize);
46+
memcpy(dst->fImage, alphaPlane, planeSize);
47+
SkMask::FreeImage(alphaPlane);
48+
}
49+
--
50+
2.46.1.824.gd892dcdcdd-goog
51+
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
From e7bebdbf60e2a2ebf5db87847d96445f1607997d Mon Sep 17 00:00:00 2001
2+
From: Anna Bauza <annabauza@google.com>
3+
Date: Fri, 2 Aug 2024 09:06:32 +0000
4+
Subject: [PATCH] fix: Security Report - Reveal images across users via
5+
EditUserPhotoController
6+
7+
This functionality has implemented tests on t+ branches.
8+
9+
Bug: 296915959
10+
Test: N/A
11+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:ae74e70c36ec027dd55164880d8b7225be4c85a3)
12+
Merged-In: If79af734432b14be74815a47e1026dc8369a304f
13+
Change-Id: If79af734432b14be74815a47e1026dc8369a304f
14+
---
15+
.../android/settingslib/users/EditUserPhotoController.java | 7 +++++++
16+
1 file changed, 7 insertions(+)
17+
18+
diff --git a/packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java b/packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java
19+
index 0c6cd048619c..1c3dea71ad45 100644
20+
--- a/packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java
21+
+++ b/packages/SettingsLib/src/com/android/settingslib/users/EditUserPhotoController.java
22+
@@ -18,6 +18,7 @@ package com.android.settingslib.users;
23+
24+
import android.app.Activity;
25+
import android.content.ClipData;
26+
+import android.content.ContentProvider;
27+
import android.content.ContentResolver;
28+
import android.content.Context;
29+
import android.content.Intent;
30+
@@ -140,6 +141,12 @@ public class EditUserPhotoController {
31+
return false;
32+
}
33+
34+
+ final int currentUserId = UserHandle.myUserId();
35+
+ if (currentUserId != ContentProvider.getUserIdFromUri(pictureUri, currentUserId)) {
36+
+ Log.e(TAG, "Invalid pictureUri: " + pictureUri);
37+
+ return false;
38+
+ }
39+
+
40+
switch (requestCode) {
41+
case REQUEST_CODE_CROP_PHOTO:
42+
onPhotoCropped(pictureUri);
43+
--
44+
2.46.1.824.gd892dcdcdd-goog
45+
Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
From 416bf4ce1c373c5389a0072d701d5f0903f3af73 Mon Sep 17 00:00:00 2001
2+
From: Dmitry Dementyev <dementyev@google.com>
3+
Date: Tue, 2 Jul 2024 11:02:07 -0700
4+
Subject: [PATCH] Remove authenticator data if it was disabled.
5+
6+
Test: manual
7+
Bug: 343440463
8+
Flag: EXEMPT bugfix
9+
(cherry picked from commit ddfc078af7e89641360b896f99af23a6b371b847)
10+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c2660dcf7fca3f652528d219767f65858bbbe622)
11+
Merged-In: I36bd6bf101da03c9c30a6d3c0080b801e7898bc6
12+
Change-Id: I36bd6bf101da03c9c30a6d3c0080b801e7898bc6
13+
---
14+
.../com/android/server/accounts/AccountManagerService.java | 4 ++++
15+
1 file changed, 4 insertions(+)
16+
17+
diff --git a/services/core/java/com/android/server/accounts/AccountManagerService.java b/services/core/java/com/android/server/accounts/AccountManagerService.java
18+
index d55be44f62cd..36ffc40bf5f7 100644
19+
--- a/services/core/java/com/android/server/accounts/AccountManagerService.java
20+
+++ b/services/core/java/com/android/server/accounts/AccountManagerService.java
21+
@@ -1171,6 +1171,10 @@ public class AccountManagerService
22+
obsoleteAuthType.add(type);
23+
// And delete it from the TABLE_META
24+
accountsDb.deleteMetaByAuthTypeAndUid(type, uid);
25+
+ } else if (knownUid != null && knownUid != uid) {
26+
+ Slog.w(TAG, "authenticator no longer exist for type " + type);
27+
+ obsoleteAuthType.add(type);
28+
+ accountsDb.deleteMetaByAuthTypeAndUid(type, uid);
29+
}
30+
}
31+
}
32+
--
33+
2.46.1.824.gd892dcdcdd-goog
34+
Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
From 3d87913569b4102bbbd3b3542f0d1104e7e3c13a Mon Sep 17 00:00:00 2001
2+
From: Ioana Alexandru <aioana@google.com>
3+
Date: Wed, 31 Jul 2024 13:46:30 +0000
4+
Subject: [PATCH] Check more URIs in notifications
5+
6+
Bug: 281044385
7+
Test: presubmit + tested in current release
8+
9+
(cherry picked from commit f47b41a138ebd60f7b518fb6a9d8aa8230488422,
10+
includes changes from commit 57bf60dd7b6a0a0e9785231f8ec25a458fedde64
11+
and commit 47fa2f79584b0a4e9ca7e9c6b237c4e5cf699032)
12+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:e6ed8a4bef3ec5a2517fc80ac88e2fc09b67c226)
13+
Merged-In: I1ce6bebd9452466d005505dc5b99a0fdc0e05e80
14+
Change-Id: I1ce6bebd9452466d005505dc5b99a0fdc0e05e80
15+
---
16+
core/java/android/app/Notification.java | 32 ++++++++++++-----------
17+
core/java/android/app/Person.java | 17 ++++++++++++
18+
core/java/android/widget/RemoteViews.java | 23 ++++++++++++++++
19+
3 files changed, 57 insertions(+), 15 deletions(-)
20+
21+
diff --git a/core/java/android/app/Notification.java b/core/java/android/app/Notification.java
22+
index ed8c6be73256..3aeb363b627b 100644
23+
--- a/core/java/android/app/Notification.java
24+
+++ b/core/java/android/app/Notification.java
25+
@@ -2799,7 +2799,7 @@ public class Notification implements Parcelable
26+
ArrayList<Person> people = extras.getParcelableArrayList(EXTRA_PEOPLE_LIST);
27+
if (people != null && !people.isEmpty()) {
28+
for (Person p : people) {
29+
- visitor.accept(p.getIconUri());
30+
+ p.visitUris(visitor);
31+
}
32+
}
33+
34+
@@ -2818,19 +2818,14 @@ public class Notification implements Parcelable
35+
// Notification Listeners might use directly (without the isStyle check).
36+
final Person person = extras.getParcelable(EXTRA_MESSAGING_PERSON);
37+
if (person != null) {
38+
- visitor.accept(person.getIconUri());
39+
+ person.visitUris(visitor);
40+
}
41+
42+
final Parcelable[] messages = extras.getParcelableArray(EXTRA_MESSAGES);
43+
if (!ArrayUtils.isEmpty(messages)) {
44+
for (MessagingStyle.Message message : MessagingStyle.Message
45+
.getMessagesFromBundleArray(messages)) {
46+
- visitor.accept(message.getDataUri());
47+
-
48+
- Person senderPerson = message.getSenderPerson();
49+
- if (senderPerson != null) {
50+
- visitor.accept(senderPerson.getIconUri());
51+
- }
52+
+ message.visitUris(visitor);
53+
}
54+
}
55+
56+
@@ -2838,12 +2833,7 @@ public class Notification implements Parcelable
57+
if (!ArrayUtils.isEmpty(historic)) {
58+
for (MessagingStyle.Message message : MessagingStyle.Message
59+
.getMessagesFromBundleArray(historic)) {
60+
- visitor.accept(message.getDataUri());
61+
-
62+
- Person senderPerson = message.getSenderPerson();
63+
- if (senderPerson != null) {
64+
- visitor.accept(senderPerson.getIconUri());
65+
- }
66+
+ message.visitUris(visitor);
67+
}
68+
}
69+
70+
@@ -2852,7 +2842,7 @@ public class Notification implements Parcelable
71+
// Extras for CallStyle (same reason for visiting without checking isStyle).
72+
Person callPerson = extras.getParcelable(EXTRA_CALL_PERSON);
73+
if (callPerson != null) {
74+
- visitor.accept(callPerson.getIconUri());
75+
+ callPerson.visitUris(visitor);
76+
}
77+
visitIconUri(visitor, extras.getParcelable(EXTRA_VERIFICATION_ICON));
78+
}
79+
@@ -8557,6 +8547,18 @@ public class Notification implements Parcelable
80+
return bundles;
81+
}
82+
83+
+ /**
84+
+ * See {@link Notification#visitUris(Consumer)}.
85+
+ *
86+
+ * @hide
87+
+ */
88+
+ public void visitUris(@NonNull Consumer<Uri> visitor) {
89+
+ visitor.accept(getDataUri());
90+
+ if (mSender != null) {
91+
+ mSender.visitUris(visitor);
92+
+ }
93+
+ }
94+
+
95+
/**
96+
* Returns a list of messages read from the given bundle list, e.g.
97+
* {@link #EXTRA_MESSAGES} or {@link #EXTRA_HISTORIC_MESSAGES}.
98+
diff --git a/core/java/android/app/Person.java b/core/java/android/app/Person.java
99+
index 97a794d4e4ea..c7432c571e43 100644
100+
--- a/core/java/android/app/Person.java
101+
+++ b/core/java/android/app/Person.java
102+
@@ -24,6 +24,7 @@ import android.os.Parcel;
103+
import android.os.Parcelable;
104+
105+
import java.util.Objects;
106+
+import java.util.function.Consumer;
107+
108+
/**
109+
* Provides an immutable reference to an entity that appears repeatedly on different surfaces of the
110+
@@ -177,6 +178,22 @@ public final class Person implements Parcelable {
111+
dest.writeBoolean(mIsBot);
112+
}
113+
114+
+ /**
115+
+ * Note all {@link Uri} that are referenced internally, with the expectation that Uri permission
116+
+ * grants will need to be issued to ensure the recipient of this object is able to render its
117+
+ * contents.
118+
+ * See b/281044385 for more context and examples about what happens when this isn't done
119+
+ * correctly.
120+
+ *
121+
+ * @hide
122+
+ */
123+
+ public void visitUris(@NonNull Consumer<Uri> visitor) {
124+
+ visitor.accept(getIconUri());
125+
+ if (mUri != null && !mUri.isEmpty()) {
126+
+ visitor.accept(Uri.parse(mUri));
127+
+ }
128+
+ }
129+
+
130+
/** Builder for the immutable {@link Person} class. */
131+
public static class Builder {
132+
@Nullable private CharSequence mName;
133+
diff --git a/core/java/android/widget/RemoteViews.java b/core/java/android/widget/RemoteViews.java
134+
index cecfa08c6e20..0747308eb93a 100644
135+
--- a/core/java/android/widget/RemoteViews.java
136+
+++ b/core/java/android/widget/RemoteViews.java
137+
@@ -934,6 +934,13 @@ public class RemoteViews implements Parcelable, Filter {
138+
return SET_REMOTE_VIEW_ADAPTER_LIST_TAG;
139+
}
140+
141+
+ @Override
142+
+ public void visitUris(@NonNull Consumer<Uri> visitor) {
143+
+ for (RemoteViews remoteViews : list) {
144+
+ remoteViews.visitUris(visitor);
145+
+ }
146+
+ }
147+
+
148+
int viewTypeCount;
149+
ArrayList<RemoteViews> list;
150+
}
151+
@@ -1009,6 +1016,13 @@ public class RemoteViews implements Parcelable, Filter {
152+
public int getActionTag() {
153+
return SET_REMOTE_COLLECTION_ITEMS_ADAPTER_TAG;
154+
}
155+
+
156+
+ @Override
157+
+ public void visitUris(@NonNull Consumer<Uri> visitor) {
158+
+ if (mItems != null) {
159+
+ mItems.visitUris(visitor);
160+
+ }
161+
+ }
162+
}
163+
164+
private class SetRemoteViewsAdapterIntent extends Action {
165+
@@ -6757,6 +6771,15 @@ public class RemoteViews implements Parcelable, Filter {
166+
Math.max(mViewTypeCount, 1));
167+
}
168+
}
169+
+
170+
+ /**
171+
+ * See {@link RemoteViews#visitUris(Consumer)}.
172+
+ */
173+
+ private void visitUris(@NonNull Consumer<Uri> visitor) {
174+
+ for (RemoteViews view : mViews) {
175+
+ view.visitUris(visitor);
176+
+ }
177+
+ }
178+
}
179+
180+
/**
181+
--
182+
2.46.1.824.gd892dcdcdd-goog
183+
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
From 7441cc063cd4d223ff7e6678e353ea9d349d1d71 Mon Sep 17 00:00:00 2001
2+
From: Ashish Kumar Gupta <kumarashishg@google.com>
3+
Date: Wed, 31 Jul 2024 16:02:29 +0000
4+
Subject: [PATCH] Set no data transfer on function switch timeout for accessory
5+
mode
6+
7+
In case of function switch times out, we will check whether
8+
the last function set was accessory. If this is the case, it is
9+
recommended to set the function to NONE(No data transfer) rather than
10+
setting it to the default USB function.
11+
12+
Bug: 353712853
13+
Test: Build the code, flash the device and test it.
14+
Test: atest CtsUsbManagerTestCases
15+
Test: run CtsVerifier tool
16+
Test: atest CtsUsbTests
17+
(cherry picked from commit 7c6ec68537ba8abf798afd9ab7c3e5889841171f)
18+
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:b032a602cdad00687e1fe089d66a6c4fa6925d79)
19+
Merged-In: I698e9df0333cbb51dd9bd5917a94d81273a2784a
20+
Change-Id: I698e9df0333cbb51dd9bd5917a94d81273a2784a
21+
---
22+
.../java/com/android/server/usb/UsbDeviceManager.java | 11 ++++++++---
23+
1 file changed, 8 insertions(+), 3 deletions(-)
24+
25+
diff --git a/services/usb/java/com/android/server/usb/UsbDeviceManager.java b/services/usb/java/com/android/server/usb/UsbDeviceManager.java
26+
index 2a5fd9e85d61..0d62e987523a 100644
27+
--- a/services/usb/java/com/android/server/usb/UsbDeviceManager.java
28+
+++ b/services/usb/java/com/android/server/usb/UsbDeviceManager.java
29+
@@ -719,7 +719,7 @@ public class UsbDeviceManager implements ActivityTaskManagerInternal.ScreenObser
30+
}
31+
}
32+
33+
- private void notifyAccessoryModeExit() {
34+
+ protected void notifyAccessoryModeExit() {
35+
// make sure accessory mode is off
36+
// and restore default functions
37+
Slog.d(TAG, "exited USB accessory mode");
38+
@@ -1956,8 +1956,13 @@ public class UsbDeviceManager implements ActivityTaskManagerInternal.ScreenObser
39+
* Dont force to default when the configuration is already set to default.
40+
*/
41+
if (msg.arg1 != 1) {
42+
- // Set this since default function may be selected from Developer options
43+
- setEnabledFunctions(mScreenUnlockedFunctions, false);
44+
+ if (mCurrentFunctions == UsbManager.FUNCTION_ACCESSORY) {
45+
+ notifyAccessoryModeExit();
46+
+ } else {
47+
+ // Set this since default function may be selected from Developer
48+
+ // options
49+
+ setEnabledFunctions(mScreenUnlockedFunctions, false);
50+
+ }
51+
}
52+
break;
53+
case MSG_GADGET_HAL_REGISTERED:
54+
--
55+
2.46.1.824.gd892dcdcdd-goog
56+

0 commit comments

Comments
 (0)