Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b2de4e90 authored by Mark Renouf's avatar Mark Renouf
Browse files

scrollCapture: Avoid crash if host window doesn't exist 

1. Enforce that the provided token is actually a window token
2. Allow the referenced window not to exist, in which case it
   is ignored.

Test: atest ScrollCaptureTest

Change-Id: Ic2a8e09fb397d844de06355e440435da4f8bf338
parent 749b6360

services/core/java/com/android/server/wm/WindowManagerService.java

+4 −1
Original line number Diff line number Diff line
@@ -6910,6 +6910,9 @@ public class WindowManagerService extends IWindowManager.Stub 
        if (!checkCallingPermission(READ_FRAME_BUFFER, "requestScrollCapture()")) {

            throw new SecurityException("Requires READ_FRAME_BUFFER permission");

        }

        if (behindClient != null && !isWindowToken(behindClient)) {

            throw new IllegalArgumentException("behindClient must be a window token");

        }

        final long token = Binder.clearCallingIdentity();

        try {

            synchronized (mGlobalLock) {
@@ -6922,7 +6925,7 @@ public class WindowManagerService extends IWindowManager.Stub 
                }

                WindowState topWindow = null;

                if (behindClient != null) {

                    topWindow = windowForClientLocked(null, behindClient, /* throwOnError*/ true);

                    topWindow = windowForClientLocked(null, behindClient, /* throwOnError*/ false);

                }

                WindowState targetWindow = dc.findScrollCaptureTargetWindow(topWindow, taskId);

                if (targetWindow == null) {