CVE-2024-34740 AI-generated analysis
platform/frameworks/libs/modules-utils (BinaryXmlSerializer), platform/frameworks/base (BinaryXmlTest, services/core pm ApkChecksums / PackageInstallerSession)
BinaryXmlSerializer.attributeBytesHex and attributeBytesBase64 now throw IOException when the byte array is longer than 65535 (MAX_UNSIGNED_SHORT) instead of writing a truncated 16-bit length followed by the full payload; a later commit linked by the same bug id caps the checksum signature in ApkChecksums.verifySignature at 35 * 1024 bytes.
Root cause
In java/com/android/modules/utils/BinaryXmlSerializer.java, attributeBytesHex() and attributeBytesBase64() emitted the attribute as: type byte, interned name, then mOut.writeShort(value.length) followed by mOut.write(value). The length was never validated against the 16-bit field, so a byte[] longer than 65535 produced a length prefix that did not match the number of bytes actually written. The commit message ("avoid Integer overflow") and the diff show the missing check; the bulletin rates the issue High/EoP.
How the fix works
- modules-utils 700c28908051, BinaryXmlSerializer.java:attributeBytesHex and attributeBytesBase64: imports FastDataOutput.MAX_UNSIGNED_SHORT and, after writing the type byte and the interned name but before writeShort(value.length), throws IOException("...input size (N) exceeds maximum allowed size (65535)") when value.length > MAX_UNSIGNED_SHORT, so the written length prefix always matches the payload length.
- frameworks/base e8b6505647be, core/tests/coretests/src/android/util/BinaryXmlTest.java: adds testAttributeBytes_BinaryDataOverflow (65536 bytes must throw IOException for both methods) and testAttributeBytesHex_MaximumBinaryData / testAttributeBytesBase64_MaximumBinaryData (exactly 65535 bytes must succeed). Test-only; depends on the modules-utils change.
- frameworks/base 716a1c65c273 (android-security-14.0.0_r28, also Bug 480126173), services/core/java/com/android/server/pm/ApkChecksums.java:verifySignature: adds MAX_SIGNATURE_SIZE_BYTES = 35 * 1024 and throws SignatureException("Invalid signature") when signature is null or longer than that, before the checksums blob is built. PackageInstallerSession.java:setChecksums only changes the IllegalArgumentException text to include e.getMessage().
Completeness
- The check covers both byte[] attribute writers in BinaryXmlSerializer (attributeBytesHex, attributeBytesBase64), the only two writeShort(value.length) sites shown in the diff.
- The check is placed after mOut.writeByte(ATTRIBUTE | TYPE_...) and mOut.writeInternedUTF(name) have already been emitted, so when it throws, a partial attribute header (type byte plus name, no length/data) remains in the output stream.
- The fix rejects oversized input rather than widening the length field; no wire format or parser-side change is in the material.
- Other attribute writers (attribute(), writeInternedUTF/writeUTF paths) are not touched by this commit; whether FastDataOutput enforces its own limit there is not shown in the material.
- The ApkChecksums.verifySignature cap applies to verifySignature callers such as setChecksums; it was added in a later security tag (r28) than the serializer fix (r11).
Behavior changes
- BinaryXmlSerializer.attributeBytesHex / attributeBytesBase64 now throw IOException for arrays longer than 65535 bytes (previously wrote a truncated length).
- ApkChecksums.verifySignature now throws SignatureException("Invalid signature") for a null signature or one longer than 35 * 1024 bytes; PackageInstallerSession.setChecksums surfaces an oversized signature as IllegalArgumentException("Can't verify signature: Invalid signature").
- No change to the binary XML wire format or reader is shown.
Per major
- Android 14: same fix: modules-utils 700c28908051 and base test e8b6505647be landed in android-security-14.0.0_r11; ApkChecksums hardening 716a1c65c273 landed in android-security-14.0.0_r28; at r29 the patched region is fully present (8/8 lines).
- Android 15: not affected per the bulletin (not listed); the patched region is present (8/8 lines) at android-security-15.0.0_r17.
- Android 16: not affected per the bulletin (not listed); the patched region is present (8/8 lines) at android-security-16.0.0_r8.
- Android 17: not affected per the bulletin (not listed); the patched region is present (8/8 lines) at android-security-17.0.0_r1.
Unknowns
- Which production caller passes attacker-influenced byte[] data to attributeBytesHex/attributeBytesBase64 and how a mismatched length leads to the EoP rated by the bulletin.
- Whether the ApkChecksums signature is ever written via BinaryXmlSerializer, and why that commit shares the bug id.
- Whether FastDataOutput.writeUTF / writeInternedUTF already bound string lengths (only the MAX_UNSIGNED_SHORT constant is shown).
- Why 35 * 1024 was chosen as MAX_SIGNATURE_SIZE_BYTES beyond the comment calling it arbitrary.