Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9bf08c7b authored by Svetoslav's avatar Svetoslav
Browse files

Clear binder identity when sending window change accessibility events. 

We get calls for window changes from the window manager and
as a result send accessibility events for these changes. It
is possible that the call for a windows change from the window
manager comes as a result of an unprivileged client calling
into the window manager. However, the event sending code
is performing security checks.

bug:17364244

Change-Id: Ief016f9dafd13ac35418676817848b3ea3ed4d66
parent baa5bccb

services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java

+10 −5
Original line number Diff line number Diff line
@@ -3484,11 +3484,16 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub { 
        }



        private void notifyWindowsChanged() {

            final long identity = Binder.clearCallingIdentity();

            try {

                // Let the client know the windows changed.

                AccessibilityEvent event = AccessibilityEvent.obtain(

                        AccessibilityEvent.TYPE_WINDOWS_CHANGED);

                event.setEventTime(SystemClock.uptimeMillis());

                sendAccessibilityEvent(event, mCurrentUserId);

            } finally {

                Binder.restoreCallingIdentity(identity);

            }

        }



        public boolean canGetAccessibilityNodeInfoLocked(Service service, int windowId) {