diff --git a/Patches/LineageOS-15.1/android_frameworks_base/337990.patch b/Patches/LineageOS-15.1/android_frameworks_base/337990.patch index 12253237..fbedf1cf 100644 --- a/Patches/LineageOS-15.1/android_frameworks_base/337990.patch +++ b/Patches/LineageOS-15.1/android_frameworks_base/337990.patch @@ -1,7 +1,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Manjeet Rulhania Date: Thu, 28 Apr 2022 20:23:58 +0000 -Subject: [PATCH 1/4] Fix duplicate permission privilege escalation +Subject: [PATCH] Fix duplicate permission privilege escalation Duplicate permissions definition with different group allows privilege permission escalation to a different permission group. diff --git a/Patches/LineageOS-15.1/android_frameworks_base/337991.patch b/Patches/LineageOS-15.1/android_frameworks_base/337991.patch index 445566e9..83770417 100644 --- a/Patches/LineageOS-15.1/android_frameworks_base/337991.patch +++ b/Patches/LineageOS-15.1/android_frameworks_base/337991.patch @@ -1,7 +1,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Steven Moreland Date: Wed, 30 Mar 2022 21:46:29 +0000 -Subject: [PATCH 2/4] Parcel: recycle recycles +Subject: [PATCH] Parcel: recycle recycles Before, it was like getting a used pan with food stuck on it. We run a clean ship here. You want a Parcel? You get a fresh Parcel. When diff --git a/Patches/LineageOS-15.1/android_frameworks_base/337992-backport.patch b/Patches/LineageOS-15.1/android_frameworks_base/337992-backport.patch index ac09a48e..6798cbd2 100644 --- a/Patches/LineageOS-15.1/android_frameworks_base/337992-backport.patch +++ b/Patches/LineageOS-15.1/android_frameworks_base/337992-backport.patch @@ -1,7 +1,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Adrian Roos Date: Thu, 24 Sep 2020 15:30:46 +0200 -Subject: [PATCH 3/4] IMMS: Make IMMS PendingIntents immutable +Subject: [PATCH] IMMS: Make IMMS PendingIntents immutable Fixes: 154913391 Test: n/a diff --git a/Patches/LineageOS-15.1/android_frameworks_base/337993.patch b/Patches/LineageOS-15.1/android_frameworks_base/337993.patch index f67e809c..3d29ea5b 100644 --- a/Patches/LineageOS-15.1/android_frameworks_base/337993.patch +++ b/Patches/LineageOS-15.1/android_frameworks_base/337993.patch @@ -1,7 +1,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Manjeet Rulhania Date: Thu, 30 Jun 2022 18:52:50 +0000 -Subject: [PATCH 4/4] Remove package name from SafetyNet logs +Subject: [PATCH] Remove package name from SafetyNet logs Bug: 213323615 Test: AppSecurityTests diff --git a/Patches/LineageOS-15.1/android_system_bt/337995-backport.patch b/Patches/LineageOS-15.1/android_system_bt/337995-backport.patch index 141c92b3..119f2e36 100644 --- a/Patches/LineageOS-15.1/android_system_bt/337995-backport.patch +++ b/Patches/LineageOS-15.1/android_system_bt/337995-backport.patch @@ -15,10 +15,10 @@ CRs-Fixed: 3155069 3 files changed, 24 insertions(+), 5 deletions(-) diff --git a/stack/bnep/bnep_api.cc b/stack/bnep/bnep_api.cc -index 4d1c2d99e..817507320 100644 +index e5d3c0948..60c8d1117 100644 --- a/stack/bnep/bnep_api.cc +++ b/stack/bnep/bnep_api.cc -@@ -360,7 +360,7 @@ tBNEP_RESULT BNEP_WriteBuf(uint16_t handle, const RawAddress& p_dest_addr, +@@ -355,7 +355,7 @@ tBNEP_RESULT BNEP_WriteBuf(uint16_t handle, const RawAddress& p_dest_addr, /* Check if the packet should be filtered out */ p_data = (uint8_t*)(p_buf + 1) + p_buf->offset; if (bnep_is_packet_allowed(p_bcb, p_dest_addr, protocol, fw_ext_present, @@ -27,7 +27,7 @@ index 4d1c2d99e..817507320 100644 /* ** If packet is filtered and ext headers are present ** drop the data and forward the ext headers -@@ -372,6 +372,11 @@ tBNEP_RESULT BNEP_WriteBuf(uint16_t handle, const RawAddress& p_dest_addr, +@@ -367,6 +367,11 @@ tBNEP_RESULT BNEP_WriteBuf(uint16_t handle, const RawAddress& p_dest_addr, org_len = p_buf->len; new_len = 0; do { @@ -39,7 +39,7 @@ index 4d1c2d99e..817507320 100644 ext = *p_data++; length = *p_data++; p_data += length; -@@ -466,7 +471,7 @@ tBNEP_RESULT BNEP_Write(uint16_t handle, const RawAddress& p_dest_addr, +@@ -457,7 +462,7 @@ tBNEP_RESULT BNEP_Write(uint16_t handle, const RawAddress& p_dest_addr, /* Check if the packet should be filtered out */ if (bnep_is_packet_allowed(p_bcb, p_dest_addr, protocol, fw_ext_present, @@ -48,7 +48,7 @@ index 4d1c2d99e..817507320 100644 /* ** If packet is filtered and ext headers are present ** drop the data and forward the ext headers -@@ -479,6 +484,10 @@ tBNEP_RESULT BNEP_Write(uint16_t handle, const RawAddress& p_dest_addr, +@@ -470,6 +475,10 @@ tBNEP_RESULT BNEP_Write(uint16_t handle, const RawAddress& p_dest_addr, new_len = 0; p = p_data; do { diff --git a/Patches/LineageOS-15.1/android_system_bt/337996.patch b/Patches/LineageOS-15.1/android_system_bt/337996.patch index b7fd5454..0fcb447b 100644 --- a/Patches/LineageOS-15.1/android_system_bt/337996.patch +++ b/Patches/LineageOS-15.1/android_system_bt/337996.patch @@ -1,7 +1,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Chienyuan Date: Wed, 30 Jan 2019 19:17:03 +0800 -Subject: [PATCH 1/2] Fix OOB in BNEP_Write +Subject: [PATCH] Fix OOB in BNEP_Write Bug: 112050583 Test: PoC @@ -13,7 +13,7 @@ CRs-Fixed: 3155069 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/stack/bnep/bnep_api.cc b/stack/bnep/bnep_api.cc -index e5d3c0948..4d1c2d99e 100644 +index 60c8d1117..817507320 100644 --- a/stack/bnep/bnep_api.cc +++ b/stack/bnep/bnep_api.cc @@ -346,10 +346,15 @@ tBNEP_RESULT BNEP_WriteBuf(uint16_t handle, const RawAddress& p_dest_addr, @@ -33,7 +33,7 @@ index e5d3c0948..4d1c2d99e 100644 } /* Check if the packet should be filtered out */ -@@ -446,9 +451,13 @@ tBNEP_RESULT BNEP_Write(uint16_t handle, const RawAddress& p_dest_addr, +@@ -451,9 +456,13 @@ tBNEP_RESULT BNEP_Write(uint16_t handle, const RawAddress& p_dest_addr, /* Check MTU size. Consider the possibility of having extension headers */ if (len > BNEP_MTU_SIZE) { diff --git a/Patches/LineageOS-15.1/android_system_bt/337997.patch b/Patches/LineageOS-15.1/android_system_bt/337997.patch index 7ec67d14..bbf8c36e 100644 --- a/Patches/LineageOS-15.1/android_system_bt/337997.patch +++ b/Patches/LineageOS-15.1/android_system_bt/337997.patch @@ -1,7 +1,7 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Venkata Jagadeesh Garaga Date: Tue, 22 Mar 2022 13:35:43 +0530 -Subject: [PATCH 2/2] Fix OOB in reassemble_and_dispatch +Subject: [PATCH] Fix OOB in reassemble_and_dispatch Fix OOB while reading L2cap length in HCI pkt diff --git a/Patches/LineageOS-16.0/android_frameworks_base/0013-Sensors_Permission.patch b/Patches/LineageOS-16.0/android_frameworks_base/0013-Sensors_Permission.patch index 01339574..7e2b76e1 100644 --- a/Patches/LineageOS-16.0/android_frameworks_base/0013-Sensors_Permission.patch +++ b/Patches/LineageOS-16.0/android_frameworks_base/0013-Sensors_Permission.patch @@ -13,10 +13,10 @@ body sensors. 4 files changed, 29 insertions(+), 1 deletion(-) diff --git a/core/java/android/content/pm/PackageParser.java b/core/java/android/content/pm/PackageParser.java -index e0c2d2dc6dde..b89c46132b26 100644 +index d99302d6696f..30f873d70400 100644 --- a/core/java/android/content/pm/PackageParser.java +++ b/core/java/android/content/pm/PackageParser.java -@@ -280,6 +280,8 @@ public class PackageParser { +@@ -282,6 +282,8 @@ public class PackageParser { */ public static final PackageParser.NewPermissionInfo NEW_PERMISSIONS[] = new PackageParser.NewPermissionInfo[] { diff --git a/Patches/LineageOS-16.0/android_frameworks_base/337992-Backport.patch b/Patches/LineageOS-16.0/android_frameworks_base/337992-Backport.patch index 02099499..7b42feb2 100644 --- a/Patches/LineageOS-16.0/android_frameworks_base/337992-Backport.patch +++ b/Patches/LineageOS-16.0/android_frameworks_base/337992-Backport.patch @@ -1,4 +1,4 @@ -From 3a1887eb6147d7e51a79c387aaed38c08056c789 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Adrian Roos Date: Thu, 24 Sep 2020 15:30:46 +0200 Subject: [PATCH] IMMS: Make IMMS PendingIntents immutable @@ -19,7 +19,7 @@ diff --git a/services/core/java/com/android/server/InputMethodManagerService.jav index 412b314aefbf..e728b0aa92e8 100644 --- a/services/core/java/com/android/server/InputMethodManagerService.java +++ b/services/core/java/com/android/server/InputMethodManagerService.java -@@ -1402,7 +1402,8 @@ public void executeMessage(Message msg) { +@@ -1402,7 +1402,8 @@ public class InputMethodManagerService extends IInputMethodManager.Stub Intent intent = new Intent(ACTION_SHOW_INPUT_METHOD_PICKER) .setPackage(mContext.getPackageName()); @@ -29,7 +29,7 @@ index 412b314aefbf..e728b0aa92e8 100644 mShowOngoingImeSwitcherForPhones = false; -@@ -2003,7 +2004,8 @@ InputBindResult startInputInnerLocked() { +@@ -2003,7 +2004,8 @@ public class InputMethodManagerService extends IInputMethodManager.Stub mCurIntent.putExtra(Intent.EXTRA_CLIENT_LABEL, com.android.internal.R.string.input_method_binding_label); mCurIntent.putExtra(Intent.EXTRA_CLIENT_INTENT, PendingIntent.getActivity( diff --git a/Scripts/LineageOS-15.1/Patch.sh b/Scripts/LineageOS-15.1/Patch.sh index 3ae60163..4489297c 100644 --- a/Scripts/LineageOS-15.1/Patch.sh +++ b/Scripts/LineageOS-15.1/Patch.sh @@ -130,10 +130,10 @@ applyPatch "$DOS_PATCHES/android_frameworks_base/335117-backport.patch"; #P_asb_ #applyPatch "$DOS_PATCHES/android_frameworks_base/335119.patch"; #P_asb_2022-08 Remove package title from notification access confirmation intent TODO: 335116 must be backported applyPatch "$DOS_PATCHES/android_frameworks_base/335120.patch"; #P_asb_2022-08 Stop using invalid URL to prevent unexpected crash applyPatch "$DOS_PATCHES/android_frameworks_base/335121-backport.patch"; #P_asb_2022-08 Only allow the system server to connect to sync adapters -applyPatch "$DOS_PATCHES/android_frameworks_base/337990.patch"; #Q_asb_2022-09 Fix duplicate permission privilege escalation +#applyPatch "$DOS_PATCHES/android_frameworks_base/337990.patch"; #Q_asb_2022-09 Fix duplicate permission privilege escalation #XXX: needs getProtection() backport applyPatch "$DOS_PATCHES/android_frameworks_base/337991.patch"; #Q_asb_2022-09 Parcel: recycle recycles applyPatch "$DOS_PATCHES/android_frameworks_base/337992-backport.patch"; #Q_asb_2022-09 IMMS: Make IMMS PendingIntents immutable -applyPatch "$DOS_PATCHES/android_frameworks_base/337993.patch"; #Q_asb_2022-09 Remove package name from SafetyNet logs +#applyPatch "$DOS_PATCHES/android_frameworks_base/337993.patch"; #Q_asb_2022-09 Remove package name from SafetyNet logs #XXX: depends on 337990 applyPatch "$DOS_PATCHES_COMMON/android_frameworks_base/0001-Browser_No_Location.patch"; #Don't grant location permission to system browsers (GrapheneOS) applyPatch "$DOS_PATCHES_COMMON/android_frameworks_base/0003-SUPL_No_IMSI.patch"; #Don't send IMSI to SUPL (MSe1969) applyPatch "$DOS_PATCHES_COMMON/android_frameworks_base/0004-Fingerprint_Lockout.patch"; #Enable fingerprint lockout after three failed attempts (GrapheneOS)