Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1f5b7013 authored by Chavi Weingarten's avatar Chavi Weingarten
Browse files

Clear calling identity in replaceContentOnDisplay 

There's some code later on that will check if the call came from system.
If it didn't, it can cause issues with creating a DC and possibly crash.
Clear calling identity after doing the permission check.

Test: CtsSurfaceControlTests
Bug: 292293769
Change-Id: I6aa79f8e9eb2e2f6ea1420e09f69fa8ab9d837e4
parent 7a2b51da

services/core/java/com/android/server/wm/WindowManagerService.java

+11 −7
Original line number Diff line number Diff line
@@ -9591,14 +9591,18 @@ public class WindowManagerService extends IWindowManager.Stub 
            throw new SecurityException("Requires ACCESS_SURFACE_FLINGER permission");

        }



        DisplayContent dc;

        final long origId = Binder.clearCallingIdentity();

        try {

            synchronized (mGlobalLock) {

            dc = mRoot.getDisplayContentOrCreate(displayId);

                DisplayContent dc = mRoot.getDisplayContentOrCreate(displayId);

                if (dc == null) {

                    return false;

                }

                dc.replaceContent(sc);

                return true;

            }

        } finally {

            Binder.restoreCallingIdentity(origId);

        }

    }

}