Synchronize on java.security.Security.class for PRNG fixes

Prevent possible race conditions with other implementations of PRNG fixes. See tozny/java-aes-crypto#11. Fixes #151
braintree · Jun 27, 2017 · cbcca9e · cbcca9e
1 parent 60fa7db
commit cbcca9e
Showing 1 changed file with 38 additions and 31 deletions.
diff --git a/PayPalOneTouch/src/main/java/com/paypal/android/sdk/onetouch/core/encryption/PRNGFixes.java b/PayPalOneTouch/src/main/java/com/paypal/android/sdk/onetouch/core/encryption/PRNGFixes.java
@@ -93,39 +93,46 @@ private static void installLinuxPRNGSecureRandom()
             return;
         }
 
-        // Install a Linux PRNG-based SecureRandom implementation as the
-        // default, if not yet installed.
-        Provider[] secureRandomProviders =
-                Security.getProviders("SecureRandom.SHA1PRNG");
-        if ((secureRandomProviders == null)
-                || (secureRandomProviders.length < 1)
-                || (!LinuxPRNGSecureRandomProvider.class.equals(
-                secureRandomProviders[0].getClass()))) {
-            Security.insertProviderAt(new LinuxPRNGSecureRandomProvider(), 1);
-        }
+        // Insert and check the provider atomically.
+        // The official Android Java libraries use synchronized methods for
+        // insertProviderAt, etc., so synchronizing on the class should
+        // make things more stable, and prevent race conditions with other
+        // versions of this code.
+        synchronized (java.security.Security.class) {
+            // Install a Linux PRNG-based SecureRandom implementation as the
+            // default, if not yet installed.
+            Provider[] secureRandomProviders =
+                    Security.getProviders("SecureRandom.SHA1PRNG");
+            if ((secureRandomProviders == null)
+                    || (secureRandomProviders.length < 1)
+                    || (!LinuxPRNGSecureRandomProvider.class.equals(
+                    secureRandomProviders[0].getClass()))) {
+                Security.insertProviderAt(new LinuxPRNGSecureRandomProvider(), 1);
+            }
 
-        // Assert that new SecureRandom() and
-        // SecureRandom.getInstance("SHA1PRNG") return a SecureRandom backed
-        // by the Linux PRNG-based SecureRandom implementation.
-        SecureRandom rng1 = new SecureRandom();
-        if (!LinuxPRNGSecureRandomProvider.class.equals(
-                rng1.getProvider().getClass())) {
-            throw new SecurityException(
-                    "new SecureRandom() backed by wrong Provider: "
-                            + rng1.getProvider().getClass());
-        }
+            // Assert that new SecureRandom() and
+            // SecureRandom.getInstance("SHA1PRNG") return a SecureRandom backed
+            // by the Linux PRNG-based SecureRandom implementation.
+            SecureRandom rng1 = new SecureRandom();
+            if (!LinuxPRNGSecureRandomProvider.class.equals(
+                    rng1.getProvider().getClass())) {
+                throw new SecurityException(
+                        "new SecureRandom() backed by wrong Provider: "
+                                + rng1.getProvider().getClass());
+            }
 
-        SecureRandom rng2;
-        try {
-            rng2 = SecureRandom.getInstance("SHA1PRNG");
-        } catch (NoSuchAlgorithmException e) {
-            throw new SecurityException("SHA1PRNG not available", e);
-        }
-        if (!LinuxPRNGSecureRandomProvider.class.equals(
-                rng2.getProvider().getClass())) {
-            throw new SecurityException(
-                    "SecureRandom.getInstance(\"SHA1PRNG\") backed by wrong"
-                            + " Provider: " + rng2.getProvider().getClass());
+            SecureRandom rng2;
+            try {
+                rng2 = SecureRandom.getInstance("SHA1PRNG");
+            } catch (NoSuchAlgorithmException e) {
+                throw new SecurityException("SHA1PRNG not available", e);
+            }
+            if (!LinuxPRNGSecureRandomProvider.class.equals(
+                    rng2.getProvider().getClass())) {
+                throw new SecurityException(
+                        "SecureRandom.getInstance(\"SHA1PRNG\") backed by wrong"
+                                + " Provider: " + rng2.getProvider().getClass());
+            }
         }
     }