{"push_id":1545027455,"size":4,"distinct_size":4,"ref":"refs/heads/n7.1.1","head":"dfee2f8d619cd2b7dee6965992bbc811a5a1da8a","before":"1979b49e27df4385fe2c8852a92d29b2d1902ff5","commits":[{"sha":"b51743fb48b65a57a2b6bc7cfa86099ec4d3b750","author":{"name":"Jeff Sharkey","email":"2e44d689a3b41cedc300fae56f237e5dfc2058cc@android.com"},"message":"DO NOT MERGE: Check provider access for content changes.\n\nFor an app to either send or receive content change notifications,\nrequire that they have some level of access to the underlying\nprovider.\n\nWithout these checks, a malicious app could sniff sensitive user data\nfrom the notifications of otherwise private providers.\n\nTest: builds, boots, PoC app now fails\nBug: 32555637\nChange-Id: If2dcd45cb0a9f1fb3b93e39fc7b8ae9c34c2fdef\n(cherry picked from commit c813f5dae231bd8f01864227c5dba10d43a89249)","distinct":true,"url":"https://api.github.com/repos/fraz14/frameworks_base/commits/b51743fb48b65a57a2b6bc7cfa86099ec4d3b750"},{"sha":"c590ecf93f998706a3a6072fd38c6992dad527e7","author":{"name":"Jeff Sharkey","email":"2e44d689a3b41cedc300fae56f237e5dfc2058cc@android.com"},"message":"DO NOT MERGE. Retain DownloadManager Uri grants when clearing.\n\nAs part of fixing a recent security issue, DownloadManager now needs\nto issue Uri permission grants for all downloads.  However, if an app\nthat requested a download is upgraded or otherwise force-stopped,\nthe required permission grants are removed.\n\nWe could tell DownloadManager about the app being stopped, but that\nwould be racy (due to background broadcast), and waking it up would\ndegrade system health.  Instead, as a special case we now only\nconsider clearing DownloadManager permission grants when app data\nis being cleared.\n\nBug: 32172542, 30537115\nTest: builds, boots, app upgrade doesn't clear grants\nChange-Id: I7e3d4546fd12bfe5f81b9fb9857ece58d574a6b9\n(cherry picked from commit 23ec811266fb728cf159a90ce4882b3c9bac1887)\n(cherry picked from commit 6eee8e37fd06bd47dd19b8503bc30cc8ccaf72a7)","distinct":true,"url":"https://api.github.com/repos/fraz14/frameworks_base/commits/c590ecf93f998706a3a6072fd38c6992dad527e7"},{"sha":"097d3fcba3f63728b11a872e93fe298420ad9859","author":{"name":"Svetoslav Ganov","email":"53ec73cf670960508d7b18dec22cf4190c97a2c6@google.com"},"message":"Fix vulnerability in MemoryIntArray\n\nMemoryIntArray was using the size of the undelying\nashmem region to mmap the data but the ashmem size\ncan be changed until the former is memory mapped.\nSince we use the ashmem region size for boundary\nchecking and memory unmapping if it does not match\nthe size used while mapping an attacker can force\nthe system to unmap memory or to access undefined\nmemory and crash.\n\nAlso we were passing the memory address where the\nashmem region is mapped in the owner process to\nsupport cases where the client can pass back the\nMemoryIntArray instance. This allows an attacker\nto put invalid address and cause arbitrary memory\nto be freed.\n\nNow we no longer support passing back the instance\nto the owner process (the passed back instance is\nread only), so no need to pass the memory adress\nof the owner's mapping, thus not allowing freeing\narbitrary memory.\n\n Further, we now check the memory mapped size against\n the size of the underlying ashmem region after we do\n the memory mapping (to fix the ahsmem size) and if\n an attacker changed the size under us we throw.\n\n Tests: Updated the tests and they pass.\n\n bug:33039926\n bug:33042690\n\nChange-Id: I1004579181ff7a223ef659e85c46100c47ab2409\n(cherry picked from commit a97171ec499fd876722733f35e51d0d6dbd8d223)","distinct":true,"url":"https://api.github.com/repos/fraz14/frameworks_base/commits/097d3fcba3f63728b11a872e93fe298420ad9859"},{"sha":"dfee2f8d619cd2b7dee6965992bbc811a5a1da8a","author":{"name":"Svet Ganov","email":"53ec73cf670960508d7b18dec22cf4190c97a2c6@google.com"},"message":"[DO NOT MERGE] Fix vulnerability in MemoryIntArray - fix build file\n\nbug:33039926\nbug:33042690\n\nChange-Id: If0431b77ec546c72f8cc25bb605a851572bb22a6\n(cherry picked from commit c3db570a0064b2dcbe806ddb5de3f678623612ca)","distinct":true,"url":"https://api.github.com/repos/fraz14/frameworks_base/commits/dfee2f8d619cd2b7dee6965992bbc811a5a1da8a"}]}
{"actor":{"display_login":"fraz14"}}