Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7e04887e authored by Jon Miranda's avatar Jon Miranda
Browse files

Address SessionCommitReceiver vulnerability by validating intent. 

Bug: 144081762
Change-Id: I28699d26abefc716e57c281c15699f15003229b2
parent f788bbb0

src/com/android/launcher3/SessionCommitReceiver.java

+6 −1
Original line number Diff line number Diff line
@@ -71,8 +71,13 @@ public class SessionCommitReceiver extends BroadcastReceiver { 


        SessionInfo info = intent.getParcelableExtra(PackageInstaller.EXTRA_SESSION);

        UserHandle user = intent.getParcelableExtra(Intent.EXTRA_USER);

        PackageInstallerCompat packageInstallerCompat = PackageInstallerCompat.getInstance(context);

        if (!PackageInstaller.ACTION_SESSION_COMMITTED.equals(intent.getAction())

                || info == null || user == null) {

            // Invalid intent.

            return;

        }



        PackageInstallerCompat packageInstallerCompat = PackageInstallerCompat.getInstance(context);

        if (TextUtils.isEmpty(info.getAppPackageName())

                || info.getInstallReason() != PackageManager.INSTALL_REASON_USER

                || packageInstallerCompat.promiseIconAddedForId(info.getSessionId())) {