CTS-testIMemoryElevationOfPrivilegeExploit

android.security.cts.IMemoryHeapCorruptionTest -- testIMemoryElevationOfPrivilegeExploit fail junit.framework.AssertionFailedError: Device is vulnerable to bug #26877992!! For more information, refer - https://android.googlesource.com/platform/frameworks/native/+/f3199c228aced7858b75a8070b8358c155ae0149 at junit.framework.Assert.fail(Assert.java:50)

修改方法：

--- a/idh.code/frameworks/native/libs/binder/IMemory.cpp +++ b/idh.code/frameworks/native/libs/binder/IMemory.cpp @@ -187,15 +187,26 @@ sp<IMemoryHeap> BpMemory::getMemory(ssize_t* offset, size_t* size) const if (heap != 0) { mHeap = interface_cast<IMemoryHeap>(heap); if (mHeap != 0) { - mOffset = o; - mSize = s; + size_t heapSize = mHeap->getSize(); + if (s <= heapSize + && o >= 0 + && (static_cast<size_t>(o) <= heapSize - s)) { + mOffset = o; + mSize = s; + } else { + // Hm. + android_errorWriteWithInfoLog(0x534e4554, + "26877992", -1, NULL, 0); + mOffset = 0; + mSize = 0; + } } } } } if (offset) *offset = mOffset; if (size) *size = mSize; - return mHeap; + return (mSize > 0) ? mHeap : 0; }