tree ca3c15b1f795e1b5684677344156e6df8e37e86f
parent deb745d6ce5e2315acbd0b1028041ca08cc6fc5d
author Andre Furtado <afurtado@google.com> 1471650602 -0700
committer Andre Furtado <afurtado@google.com> 1471654987 +0000

30481342: Security Vulnerability - TOCTOU in MmsProvider allows access to files as phone (radio) uid - DO NOT MERGE

Problem: MmsProvider.openFile validated the current _data column
in the DB and then called ContentProvider.openFileHelper which was again
reading from the DB. A race condition could cause the second DB read to
read an updated, malicious value.

Fix: instead of doing the first DB check and calling
ContentProvider.openFileHelper, we're now just calling
MmsProvider.safeOpenFileHelper which does a single check.

Test: used the POC provided for this incident.

b/30481342

Change-Id: I643ad76bdbbbc68c4b7dbd18f7e76021396d5ed8