tree df469e7951c3ce93b73544fc6a2a99512deac5f5
parent ce42c6449ceff2ba2737ceced05ac8f0966361d7
author Andre Furtado <afurtado@google.com> 1471541317 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> 1475863756 -0700

30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to files as phone (radio) uid

Problem: MmsProvider.openFile validated the current _data column
in the DB and then called ContentProvider.openFileHelper which was again
reading from the DB. A race condition could cause the second DB read to
read an updated, malicious value.

Fix: instead of doing the first DB check and calling
ContentProvider.openFileHelper, we're now just calling
MmsProvider.safeOpenFileHelper which does a single check.

Test: used the POC provided for this incident.

b/30481342

Change-Id: I653129359130b9fae59d4c355320b266c158a698
(cherry picked from commit 5bc7f9682d72c89ba252be6471b2db9b7e7815e3)
(cherry picked from commit 6a3361528aef860b2f1ba276957b11f809ce1ffe)