Merge "Prevent activity token leaked to another process" into main (3f1a426b) · Commits · e / os / android_frameworks_base

services/core/java/com/android/server/wm/TaskFragmentOrganizerController.java

+7 −2

Original line number	Diff line number	Diff line
		@@ -429,7 +429,7 @@ public class TaskFragmentOrganizerController extends ITaskFragmentOrganizerContr
		}

		final IBinder activityToken;
		if (activity.getPid() == mOrganizerPid) {
		if (activity.getPid() == mOrganizerPid && activity.getUid() == mOrganizerUid) {
		// We only pass the actual token if the activity belongs to the organizer process.
		activityToken = activity.token;
		} else {
		@@ -458,7 +458,8 @@ public class TaskFragmentOrganizerController extends ITaskFragmentOrganizerContr
		change.setTaskFragmentToken(lastParentTfToken);
		}
		// Only pass the activity token to the client if it belongs to the same process.
		if (nextFillTaskActivity != null && nextFillTaskActivity.getPid() == mOrganizerPid) {
		if (nextFillTaskActivity != null && nextFillTaskActivity.getPid() == mOrganizerPid
		&& nextFillTaskActivity.getUid() == mOrganizerUid) {
		change.setOtherActivityToken(nextFillTaskActivity.token);
		}
		return change;
		@@ -553,6 +554,10 @@ public class TaskFragmentOrganizerController extends ITaskFragmentOrganizerContr
		"Replacing existing organizer currently unsupported");
		}

		if (pid <= 0) {
		throw new IllegalStateException("Cannot register from invalid pid: " + pid);
		}

		if (restoreFromCachedStateIfPossible(organizer, pid, uid, outSavedState)) {
		return;
		}