Assert that setEnabledProtocols/CipherSuites copy their inputs.
SSLSocket, SSLServerSocket, and SSLEngine offer setEnabledProtocols and setEnabledCipherSuites methods which take an array of protocols or cipher suites as input. If these methods store references to the input arrays, then the internal state (lists of enabled protocols and cipher suites) of SSLSocket, SSLServerSocket, and SSLEngine could be modified without going through the setter methods of these classes. Correct implementations of these methods should store copies of the input arrays. Bug: 15753142 Change-Id: Ia5248050d81320ed1da99892278bd60872605f52
Loading
Please sign in to comment