Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit be09d5f6 authored by Pinyao Ting's avatar Pinyao Ting
Browse files

Properly handle onNullBinding() in appwidget service. 


Bug: 340239088
Change-Id: I12fccb572e159a73785aa33a4f5204e094ccd1b7
Test: manually verified with the PoC app
Flag: EXEMPT CVE
parent 3bc44be9

core/java/android/widget/RemoteViews.java

+5 −0
Original line number Diff line number Diff line
@@ -1447,6 +1447,11 @@ public class RemoteViews implements Parcelable, Filter { 
                            result.complete(items);

                        }



                        @Override

                        public void onNullBinding(ComponentName name) {

                            context.unbindService(this);

                        }



                        @Override

                        public void onServiceDisconnected(ComponentName componentName) { }

                    });

core/java/android/widget/RemoteViewsAdapter.java

+5 −0
Original line number Diff line number Diff line
@@ -240,6 +240,11 @@ public class RemoteViewsAdapter extends BaseAdapter implements Handler.Callback 
            }

        }



        @Override

        public void onNullBinding(ComponentName name) {

            enqueueDeferredUnbindServiceMessage();

        }



        @Override

        public void handleMessage(Message msg) {

            RemoteViewsAdapter adapter = mAdapter.get();

services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java

+10 −0
Original line number Diff line number Diff line
@@ -2372,6 +2372,11 @@ class AppWidgetServiceImpl extends IAppWidgetService.Stub implements WidgetBacku 
                mContext.unbindService(this);

            }



            @Override

            public void onNullBinding(ComponentName name) {

                mContext.unbindService(this);

            }



            @Override

            public void onServiceDisconnected(ComponentName name) {

                // Do nothing
@@ -2519,6 +2524,11 @@ class AppWidgetServiceImpl extends IAppWidgetService.Stub implements WidgetBacku 
                                mContext.unbindService(this);

                            }



                            @Override

                            public void onNullBinding(ComponentName name) {

                                mContext.unbindService(this);

                            }



                            @Override

                            public void onServiceDisconnected(android.content.ComponentName name) {

                                // Do nothing