run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testMaliciousMapWrite

[CTS][Android9.0]

 

run cts -m CtsOsTestCases -t android.os.cts.ParcelTest#testMaliciousMapWrite

junit.framework.AssertionFailedError: Should have thrown a BadParcelableException

 

frameworks/base/core/java/android/os/Parcel.java

original source

    /* package */ void writeMapInternal(Map<String,Object> val) {
        if (val == null) {
            writeInt(-1);
            return;
        }
        Set<Map.Entry<String,Object>> entries = val.entrySet();
        writeInt(entries.size());
        for (Map.Entry<String,Object> e : entries) {
            writeValue(e.getKey());
            writeValue(e.getValue());
        }
    }

frameworks/base/core/java/android/os/Parcel.java

modified source

    /* package */ void writeMapInternal(Map<String,Object> val) {
        if (val == null) {
            writeInt(-1);
            return;
        }
        Set<Map.Entry<String,Object>> entries = val.entrySet();
        int size = entries.size();
        writeInt(size);

        for (Map.Entry<String,Object> e : entries) {
            writeValue(e.getKey());
            writeValue(e.getValue());
            size--;
        }

        if (size != 0) {
            throw new BadParcelableException("Map size does not match number of entries!");
        }

    }