Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1d9b8054 authored by Hyangseok Chae's avatar Hyangseok Chae Committed by Julia Reynolds
Browse files

Fix a missing synchronization to Notification 

Concurrent access on allPendingIntents could cause
crash by ArrayIndexOutOfBoundsException.
Below two accesses can occur in two different threads.
But allPendingIntents(ArraySet) is not thread-safe.
1. Access to write.
   allPendingIntents = new ArraySet<>();
   parcel.writeArraySet(allPendingIntents)
2. Access to add.
   allPendingIntents.add(intent);

So, we added missing synchronization to Notification

Test:
It is hard to reproduce by manual.
Make/Update notification with pendingintent.

Change-Id: Ib866f6b92528f7a944ac93997a9cff07892d4192
Bugs: 144081764
parent 5fdaa0c9

core/java/android/app/Notification.java

+9 −5
Original line number Diff line number Diff line
@@ -2576,19 +2576,23 @@ public class Notification implements Parcelable 
            PendingIntent.setOnMarshaledListener(

                    (PendingIntent intent, Parcel out, int outFlags) -> {

                if (parcel == out) {

                    synchronized (this) {

                        if (allPendingIntents == null) {

                            allPendingIntents = new ArraySet<>();

                        }

                        allPendingIntents.add(intent);

                    }

                }

            });

        }

        try {

            // IMPORTANT: Add marshaling code in writeToParcelImpl as we

            // want to intercept all pending events written to the parcel.

            writeToParcelImpl(parcel, flags);

            synchronized (this) {

                // Must be written last!

                parcel.writeArraySet(allPendingIntents);

            }

        } finally {

            if (collectPendingIntents) {

                PendingIntent.setOnMarshaledListener(null);