Loading core/java/android/os/Parcel.java +23 −4 Original line number Diff line number Diff line Loading @@ -614,7 +614,7 @@ public final class Parcel { int startPos; for (int i=0; i<N; i++) { if (DEBUG_ARRAY_MAP) startPos = dataPosition(); writeValue(val.keyAt(i)); writeString(val.keyAt(i)); writeValue(val.valueAt(i)); if (DEBUG_ARRAY_MAP) Log.d(TAG, " Write #" + i + " " + (dataPosition()-startPos) + " bytes: key=0x" Loading @@ -623,6 +623,13 @@ public final class Parcel { } } /** * @hide For testing only. */ public void writeArrayMap(ArrayMap<String, Object> val) { writeArrayMapInternal(val); } /** * Flatten a Bundle into the parcel at the current dataPosition(), * growing dataCapacity() if needed. Loading Loading @@ -2310,7 +2317,7 @@ public final class Parcel { int startPos; while (N > 0) { if (DEBUG_ARRAY_MAP) startPos = dataPosition(); Object key = readValue(loader); String key = readString(); Object value = readValue(loader); if (DEBUG_ARRAY_MAP) Log.d(TAG, " Read #" + (N-1) + " " + (dataPosition()-startPos) + " bytes: key=0x" Loading @@ -2318,6 +2325,7 @@ public final class Parcel { outVal.append(key, value); N--; } outVal.validate(); } /* package */ void readArrayMapSafelyInternal(ArrayMap outVal, int N, Loading @@ -2328,7 +2336,7 @@ public final class Parcel { Log.d(TAG, "Reading safely " + N + " ArrayMap entries", here); } while (N > 0) { Object key = readValue(loader); String key = readString(); if (DEBUG_ARRAY_MAP) Log.d(TAG, " Read safe #" + (N-1) + ": key=0x" + (key != null ? key.hashCode() : 0) + " " + key); Object value = readValue(loader); Loading @@ -2337,6 +2345,17 @@ public final class Parcel { } } /** * @hide For testing only. */ public void readArrayMap(ArrayMap outVal, ClassLoader loader) { final int N = readInt(); if (N < 0) { return; } readArrayMapInternal(outVal, N, loader); } private void readListInternal(List outVal, int N, ClassLoader loader) { while (N > 0) { Loading core/java/android/util/ArrayMap.java +38 −0 Original line number Diff line number Diff line Loading @@ -493,6 +493,44 @@ public final class ArrayMap<K, V> implements Map<K, V> { mArray[index+1] = value; } /** * The use of the {@link #append} function can result in invalid array maps, in particular * an array map where the same key appears multiple times. This function verifies that * the array map is valid, throwing IllegalArgumentException if a problem is found. The * main use for this method is validating an array map after unpacking from an IPC, to * protect against malicious callers. * @hide */ public void validate() { final int N = mSize; if (N <= 1) { // There can't be dups. return; } int basehash = mHashes[0]; int basei = 0; for (int i=1; i<N; i++) { int hash = mHashes[i]; if (hash != basehash) { basehash = hash; basei = i; continue; } // We are in a run of entries with the same hash code. Go backwards through // the array to see if any keys are the same. final Object cur = mArray[i<<1]; for (int j=i-1; j>=basei; j--) { final Object prev = mArray[j<<1]; if (cur == prev) { throw new IllegalArgumentException("Duplicate key in ArrayMap: " + cur); } if (cur != null && prev != null && cur.equals(prev)) { throw new IllegalArgumentException("Duplicate key in ArrayMap: " + cur); } } } } /** * Perform a {@link #put(Object, Object)} of all key/value pairs in <var>array</var> * @param array The array whose contents are to be retrieved. Loading media/java/android/media/AudioService.java +0 −3 Original line number Diff line number Diff line Loading @@ -815,9 +815,6 @@ public class AudioService extends IAudioService.Stub { // Broadcast vibrate settings broadcastVibrateSetting(AudioManager.VIBRATE_TYPE_RINGER); broadcastVibrateSetting(AudioManager.VIBRATE_TYPE_NOTIFICATION); // Restore the default media button receiver from the system settings mMediaFocusControl.restoreMediaButtonReceiver(); } private int rescaleIndex(int index, int srcStream, int dstStream) { Loading media/java/android/media/MediaFocusControl.java +0 −56 Original line number Diff line number Diff line Loading @@ -318,7 +318,6 @@ public class MediaFocusControl implements OnFinished { //========================================================================================== // event handler messages private static final int MSG_PERSIST_MEDIABUTTONRECEIVER = 0; private static final int MSG_RCDISPLAY_CLEAR = 1; private static final int MSG_RCDISPLAY_UPDATE = 2; private static final int MSG_REEVALUATE_REMOTE = 3; Loading Loading @@ -359,9 +358,6 @@ public class MediaFocusControl implements OnFinished { @Override public void handleMessage(Message msg) { switch(msg.what) { case MSG_PERSIST_MEDIABUTTONRECEIVER: onHandlePersistMediaButtonReceiver( (ComponentName) msg.obj ); break; case MSG_RCDISPLAY_CLEAR: onRcDisplayClear(); Loading Loading @@ -1433,50 +1429,10 @@ public class MediaFocusControl implements OnFinished { } } } if (mRCStack.empty()) { // no saved media button receiver mEventHandler.sendMessage( mEventHandler.obtainMessage(MSG_PERSIST_MEDIABUTTONRECEIVER, 0, 0, null)); } else if (oldTop != mRCStack.peek()) { // the top of the stack has changed, save it in the system settings // by posting a message to persist it; only do this however if it has // a concrete component name (is not a transient registration) RemoteControlStackEntry rcse = mRCStack.peek(); if (rcse.mReceiverComponent != null) { mEventHandler.sendMessage( mEventHandler.obtainMessage(MSG_PERSIST_MEDIABUTTONRECEIVER, 0, 0, rcse.mReceiverComponent)); } } } } } /** * Helper function: * Restore remote control receiver from the system settings. */ protected void restoreMediaButtonReceiver() { String receiverName = Settings.System.getStringForUser(mContentResolver, Settings.System.MEDIA_BUTTON_RECEIVER, UserHandle.USER_CURRENT); if ((null != receiverName) && !receiverName.isEmpty()) { ComponentName eventReceiver = ComponentName.unflattenFromString(receiverName); if (eventReceiver == null) { // an invalid name was persisted return; } // construct a PendingIntent targeted to the restored component name // for the media button and register it Intent mediaButtonIntent = new Intent(Intent.ACTION_MEDIA_BUTTON); // the associated intent will be handled by the component being registered mediaButtonIntent.setComponent(eventReceiver); PendingIntent pi = PendingIntent.getBroadcast(mContext, 0/*requestCode, ignored*/, mediaButtonIntent, 0/*flags*/); registerMediaButtonIntent(pi, eventReceiver, null); } } /** * Helper function: * Set the new remote control receiver at the top of the RC focus stack. Loading Loading @@ -1515,12 +1471,6 @@ public class MediaFocusControl implements OnFinished { } mRCStack.push(rcse); // rcse is never null // post message to persist the default media button receiver if (target != null) { mEventHandler.sendMessage( mEventHandler.obtainMessage( MSG_PERSIST_MEDIABUTTONRECEIVER, 0, 0, target/*obj*/) ); } // RC stack was modified return true; } Loading Loading @@ -1559,12 +1509,6 @@ public class MediaFocusControl implements OnFinished { return false; } private void onHandlePersistMediaButtonReceiver(ComponentName receiver) { Settings.System.putStringForUser(mContentResolver, Settings.System.MEDIA_BUTTON_RECEIVER, receiver == null ? "" : receiver.flattenToString(), UserHandle.USER_CURRENT); } //========================================================================================== // Remote control display / client Loading services/java/com/android/server/am/ActivityManagerService.java +1 −1 Original line number Diff line number Diff line Loading @@ -13015,7 +13015,7 @@ public final class ActivityManagerService extends ActivityManagerNative // activity manager to announce its creation. public boolean bindBackupAgent(ApplicationInfo app, int backupMode) { if (DEBUG_BACKUP) Slog.v(TAG, "bindBackupAgent: app=" + app + " mode=" + backupMode); enforceCallingPermission("android.permission.BACKUP", "bindBackupAgent"); enforceCallingPermission("android.permission.CONFIRM_FULL_BACKUP", "bindBackupAgent"); synchronized(this) { // !!! TODO: currently no check here that we're already bound Loading
core/java/android/os/Parcel.java +23 −4 Original line number Diff line number Diff line Loading @@ -614,7 +614,7 @@ public final class Parcel { int startPos; for (int i=0; i<N; i++) { if (DEBUG_ARRAY_MAP) startPos = dataPosition(); writeValue(val.keyAt(i)); writeString(val.keyAt(i)); writeValue(val.valueAt(i)); if (DEBUG_ARRAY_MAP) Log.d(TAG, " Write #" + i + " " + (dataPosition()-startPos) + " bytes: key=0x" Loading @@ -623,6 +623,13 @@ public final class Parcel { } } /** * @hide For testing only. */ public void writeArrayMap(ArrayMap<String, Object> val) { writeArrayMapInternal(val); } /** * Flatten a Bundle into the parcel at the current dataPosition(), * growing dataCapacity() if needed. Loading Loading @@ -2310,7 +2317,7 @@ public final class Parcel { int startPos; while (N > 0) { if (DEBUG_ARRAY_MAP) startPos = dataPosition(); Object key = readValue(loader); String key = readString(); Object value = readValue(loader); if (DEBUG_ARRAY_MAP) Log.d(TAG, " Read #" + (N-1) + " " + (dataPosition()-startPos) + " bytes: key=0x" Loading @@ -2318,6 +2325,7 @@ public final class Parcel { outVal.append(key, value); N--; } outVal.validate(); } /* package */ void readArrayMapSafelyInternal(ArrayMap outVal, int N, Loading @@ -2328,7 +2336,7 @@ public final class Parcel { Log.d(TAG, "Reading safely " + N + " ArrayMap entries", here); } while (N > 0) { Object key = readValue(loader); String key = readString(); if (DEBUG_ARRAY_MAP) Log.d(TAG, " Read safe #" + (N-1) + ": key=0x" + (key != null ? key.hashCode() : 0) + " " + key); Object value = readValue(loader); Loading @@ -2337,6 +2345,17 @@ public final class Parcel { } } /** * @hide For testing only. */ public void readArrayMap(ArrayMap outVal, ClassLoader loader) { final int N = readInt(); if (N < 0) { return; } readArrayMapInternal(outVal, N, loader); } private void readListInternal(List outVal, int N, ClassLoader loader) { while (N > 0) { Loading
core/java/android/util/ArrayMap.java +38 −0 Original line number Diff line number Diff line Loading @@ -493,6 +493,44 @@ public final class ArrayMap<K, V> implements Map<K, V> { mArray[index+1] = value; } /** * The use of the {@link #append} function can result in invalid array maps, in particular * an array map where the same key appears multiple times. This function verifies that * the array map is valid, throwing IllegalArgumentException if a problem is found. The * main use for this method is validating an array map after unpacking from an IPC, to * protect against malicious callers. * @hide */ public void validate() { final int N = mSize; if (N <= 1) { // There can't be dups. return; } int basehash = mHashes[0]; int basei = 0; for (int i=1; i<N; i++) { int hash = mHashes[i]; if (hash != basehash) { basehash = hash; basei = i; continue; } // We are in a run of entries with the same hash code. Go backwards through // the array to see if any keys are the same. final Object cur = mArray[i<<1]; for (int j=i-1; j>=basei; j--) { final Object prev = mArray[j<<1]; if (cur == prev) { throw new IllegalArgumentException("Duplicate key in ArrayMap: " + cur); } if (cur != null && prev != null && cur.equals(prev)) { throw new IllegalArgumentException("Duplicate key in ArrayMap: " + cur); } } } } /** * Perform a {@link #put(Object, Object)} of all key/value pairs in <var>array</var> * @param array The array whose contents are to be retrieved. Loading
media/java/android/media/AudioService.java +0 −3 Original line number Diff line number Diff line Loading @@ -815,9 +815,6 @@ public class AudioService extends IAudioService.Stub { // Broadcast vibrate settings broadcastVibrateSetting(AudioManager.VIBRATE_TYPE_RINGER); broadcastVibrateSetting(AudioManager.VIBRATE_TYPE_NOTIFICATION); // Restore the default media button receiver from the system settings mMediaFocusControl.restoreMediaButtonReceiver(); } private int rescaleIndex(int index, int srcStream, int dstStream) { Loading
media/java/android/media/MediaFocusControl.java +0 −56 Original line number Diff line number Diff line Loading @@ -318,7 +318,6 @@ public class MediaFocusControl implements OnFinished { //========================================================================================== // event handler messages private static final int MSG_PERSIST_MEDIABUTTONRECEIVER = 0; private static final int MSG_RCDISPLAY_CLEAR = 1; private static final int MSG_RCDISPLAY_UPDATE = 2; private static final int MSG_REEVALUATE_REMOTE = 3; Loading Loading @@ -359,9 +358,6 @@ public class MediaFocusControl implements OnFinished { @Override public void handleMessage(Message msg) { switch(msg.what) { case MSG_PERSIST_MEDIABUTTONRECEIVER: onHandlePersistMediaButtonReceiver( (ComponentName) msg.obj ); break; case MSG_RCDISPLAY_CLEAR: onRcDisplayClear(); Loading Loading @@ -1433,50 +1429,10 @@ public class MediaFocusControl implements OnFinished { } } } if (mRCStack.empty()) { // no saved media button receiver mEventHandler.sendMessage( mEventHandler.obtainMessage(MSG_PERSIST_MEDIABUTTONRECEIVER, 0, 0, null)); } else if (oldTop != mRCStack.peek()) { // the top of the stack has changed, save it in the system settings // by posting a message to persist it; only do this however if it has // a concrete component name (is not a transient registration) RemoteControlStackEntry rcse = mRCStack.peek(); if (rcse.mReceiverComponent != null) { mEventHandler.sendMessage( mEventHandler.obtainMessage(MSG_PERSIST_MEDIABUTTONRECEIVER, 0, 0, rcse.mReceiverComponent)); } } } } } /** * Helper function: * Restore remote control receiver from the system settings. */ protected void restoreMediaButtonReceiver() { String receiverName = Settings.System.getStringForUser(mContentResolver, Settings.System.MEDIA_BUTTON_RECEIVER, UserHandle.USER_CURRENT); if ((null != receiverName) && !receiverName.isEmpty()) { ComponentName eventReceiver = ComponentName.unflattenFromString(receiverName); if (eventReceiver == null) { // an invalid name was persisted return; } // construct a PendingIntent targeted to the restored component name // for the media button and register it Intent mediaButtonIntent = new Intent(Intent.ACTION_MEDIA_BUTTON); // the associated intent will be handled by the component being registered mediaButtonIntent.setComponent(eventReceiver); PendingIntent pi = PendingIntent.getBroadcast(mContext, 0/*requestCode, ignored*/, mediaButtonIntent, 0/*flags*/); registerMediaButtonIntent(pi, eventReceiver, null); } } /** * Helper function: * Set the new remote control receiver at the top of the RC focus stack. Loading Loading @@ -1515,12 +1471,6 @@ public class MediaFocusControl implements OnFinished { } mRCStack.push(rcse); // rcse is never null // post message to persist the default media button receiver if (target != null) { mEventHandler.sendMessage( mEventHandler.obtainMessage( MSG_PERSIST_MEDIABUTTONRECEIVER, 0, 0, target/*obj*/) ); } // RC stack was modified return true; } Loading Loading @@ -1559,12 +1509,6 @@ public class MediaFocusControl implements OnFinished { return false; } private void onHandlePersistMediaButtonReceiver(ComponentName receiver) { Settings.System.putStringForUser(mContentResolver, Settings.System.MEDIA_BUTTON_RECEIVER, receiver == null ? "" : receiver.flattenToString(), UserHandle.USER_CURRENT); } //========================================================================================== // Remote control display / client Loading
services/java/com/android/server/am/ActivityManagerService.java +1 −1 Original line number Diff line number Diff line Loading @@ -13015,7 +13015,7 @@ public final class ActivityManagerService extends ActivityManagerNative // activity manager to announce its creation. public boolean bindBackupAgent(ApplicationInfo app, int backupMode) { if (DEBUG_BACKUP) Slog.v(TAG, "bindBackupAgent: app=" + app + " mode=" + backupMode); enforceCallingPermission("android.permission.BACKUP", "bindBackupAgent"); enforceCallingPermission("android.permission.CONFIRM_FULL_BACKUP", "bindBackupAgent"); synchronized(this) { // !!! TODO: currently no check here that we're already bound