Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 99d6cf4b authored by Daniel Norman's avatar Daniel Norman Committed by Automerger Merge Worker
Browse files

Checks if AccessibilityServiceInfo is within parcelable size. am: 553232c2... 

Checks if AccessibilityServiceInfo is within parcelable size. am: 553232c2 am: ee57ec06 am: 27f32a2f

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/21238189



Change-Id: I0f2db0de8656b5f2d12044ddda8abeb9130c7bba
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents 4de12c29 27f32a2f

core/java/android/accessibilityservice/AccessibilityService.java

+4 −0
Original line number Diff line number Diff line
@@ -2047,6 +2047,10 @@ public abstract class AccessibilityService extends Service { 
        IAccessibilityServiceConnection connection =

                AccessibilityInteractionClient.getInstance(this).getConnection(mConnectionId);

        if (mInfo != null && connection != null) {

            if (!mInfo.isWithinParcelableSize()) {

                throw new IllegalStateException(

                        "Cannot update service info: size is larger than safe parcelable limits.");

            }

            try {

                connection.setServiceInfo(mInfo);

                mInfo = null;

core/java/android/accessibilityservice/AccessibilityServiceInfo.java

+10 −0
Original line number Diff line number Diff line
@@ -40,6 +40,7 @@ import android.content.res.XmlResourceParser; 
import android.graphics.drawable.Drawable;

import android.hardware.fingerprint.FingerprintManager;

import android.os.Build;

import android.os.IBinder;

import android.os.Parcel;

import android.os.Parcelable;

import android.os.RemoteException;
@@ -1063,6 +1064,15 @@ public class AccessibilityServiceInfo implements Parcelable { 
        return 0;

    }



    /** @hide */

    public final boolean isWithinParcelableSize() {

        final Parcel parcel = Parcel.obtain();

        writeToParcel(parcel, 0);

        final boolean result = parcel.dataSize() <= IBinder.MAX_IPC_SIZE;

        parcel.recycle();

        return result;

    }



    public void writeToParcel(Parcel parcel, int flagz) {

        parcel.writeInt(eventTypes);

        parcel.writeStringArray(packageNames);

services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java

+6 −0
Original line number Diff line number Diff line
@@ -1595,6 +1595,12 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub 
            AccessibilityServiceInfo accessibilityServiceInfo;

            try {

                accessibilityServiceInfo = new AccessibilityServiceInfo(resolveInfo, mContext);

                if (!accessibilityServiceInfo.isWithinParcelableSize()) {

                    Slog.e(LOG_TAG, "Skipping service "

                            + accessibilityServiceInfo.getResolveInfo().getComponentInfo()

                            + " because service info size is larger than safe parcelable limits.");

                    continue;

                }

                if (userState.mCrashedServices.contains(serviceInfo.getComponentName())) {

                    // Restore the crashed attribute.

                    accessibilityServiceInfo.crashed = true;