Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a54d7638 authored by Hongwei Wang's avatar Hongwei Wang
Browse files

[RESTRICT AUTOMERGE] Ignore small source rect hint 

Which may be abused by malicious app to create a non-visible PiP
window that bypasses the background restriction.

Bug: 270368476
Test: Manually, using the POC app
Change-Id: Ifc0e4ffe8b7a9754053246069cb480aa6a59a7e1
parent 5d31bd1c

packages/SystemUI/src/com/android/systemui/pip/PipTaskOrganizer.java

+8 −4
Original line number Original line Diff line number Diff line
@@ -387,7 +387,8 @@ public class PipTaskOrganizer extends TaskOrganizer implements 
        final Rect currentBounds = mTaskInfo.configuration.windowConfiguration.getBounds();

        final Rect currentBounds = mTaskInfo.configuration.windowConfiguration.getBounds();





        if (mOneShotAnimationType == ANIM_TYPE_BOUNDS) {

        if (mOneShotAnimationType == ANIM_TYPE_BOUNDS) {

            final Rect sourceHintRect = getValidSourceHintRect(info, currentBounds);

            final Rect sourceHintRect = getValidSourceHintRect(info, currentBounds,

                    destinationBounds);

            scheduleAnimateResizePip(currentBounds, destinationBounds, sourceHintRect,

            scheduleAnimateResizePip(currentBounds, destinationBounds, sourceHintRect,

                    TRANSITION_DIRECTION_TO_PIP, mEnterExitAnimationDuration,

                    TRANSITION_DIRECTION_TO_PIP, mEnterExitAnimationDuration,

                    null /* updateBoundsCallback */);

                    null /* updateBoundsCallback */);
@@ -401,14 +402,17 @@ public class PipTaskOrganizer extends TaskOrganizer implements 




    /**

    /**

     * Returns the source hint rect if it is valid (if provided and is contained by the current

     * Returns the source hint rect if it is valid (if provided and is contained by the current

     * task bounds).

     * task bounds and not too small).

     */

     */

    private Rect getValidSourceHintRect(ActivityManager.RunningTaskInfo info, Rect sourceBounds) {

    private Rect getValidSourceHintRect(ActivityManager.RunningTaskInfo info, Rect sourceBounds,

            Rect destinationBounds) {

        final Rect sourceHintRect = info.pictureInPictureParams != null

        final Rect sourceHintRect = info.pictureInPictureParams != null

                && info.pictureInPictureParams.hasSourceBoundsHint()

                && info.pictureInPictureParams.hasSourceBoundsHint()

                ? info.pictureInPictureParams.getSourceRectHint()

                ? info.pictureInPictureParams.getSourceRectHint()

                : null;

                : null;

        if (sourceHintRect != null && sourceBounds.contains(sourceHintRect)) {

        if (sourceHintRect != null && sourceBounds.contains(sourceHintRect)

                && sourceHintRect.width() > destinationBounds.width()

                && sourceHintRect.height() > destinationBounds.height()) {

            return sourceHintRect;

            return sourceHintRect;

        }

        }

        return null;

        return null;